Description
Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
References (4)
Core 4
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5
Third Party Advisory x_refsource_confirm
https://github.com/NodeBB/NodeBB/security/advisories/GHSA-pfj7-2qfw-vwgm
Patch, Third Party Advisory x_refsource_misc
https://github.com/NodeBB/NodeBB/commit/c8b2fc46dc698db687379106b3f01c71b80f495f
Exploit, Third Party Advisory x_refsource_misc
https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/
Scores
CVSS v3
5.0
EPSS
0.0252
EPSS Percentile
85.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Details
CWE
CWE-22
Status
published
Products (2)
nodebb/nodebb
1.0.4 - 1.18.4
npm/nodebb
1.0.4 - 1.18.5npm
Published
Nov 29, 2021
Tracked Since
Feb 18, 2026