CVE-2019-8903

HIGH NUCLEI

Total.js prior to 3.2.4 Directory Traversal

Title source: metasploit
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-8903. PoCs published by Riccardo Krauter, Fabio Cogno, including Metasploit module auxiliary/scanner/http/totaljs_traversal. A Nuclei detection template is also available.

AI-analyzed exploit summary This Metasploit module exploits a directory traversal vulnerability (CVE-2019-8903) in Total.js prior to version 3.2.4. It allows reading arbitrary files by manipulating the URI path with traversal sequences.

Description

index.js in Total.js Platform before 3.2.3 allows path traversal.

Exploits (1)

metasploit WORKING POC
by Riccardo Krauter, Fabio Cogno · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/totaljs_traversal.rb

This Metasploit module exploits a directory traversal vulnerability (CVE-2019-8903) in Total.js prior to version 3.2.4. It allows reading arbitrary files by manipulating the URI path with traversal sequences.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Total.js prior to 3.2.4
No auth needed
Prerequisites: Target must be running a vulnerable version of Total.js · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Totaljs <3.2.3 - Local File Inclusion
HIGHby madrobot

References (3)

Core 3

Scores

CVSS v3 7.5
EPSS 0.5325
EPSS Percentile 98.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-22
Status published
Products (2)
npm/total.js 0 - 3.2.3npm
totaljs/total.js < 3.2.3
Published Feb 18, 2019
Tracked Since Feb 18, 2026