CVE-2025-27210
HIGHNode.js 20.0.0-20.19.3, 22.0.0-22.17.0, 24.0.0-24.4.0 - Path Traversal via Windows Device Names in path.join
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2025-27210. PoCs published by Abdualhadi khalifa, absholi7ly, mindeddu.
AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability in Node.js 24.x on Windows by leveraging reserved device names (e.g., AUX) to bypass path normalization. It attempts to read arbitrary files by crafting a malicious path with traverse sequences and sending it via HTTP GET or POST requests.
Description
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.
Exploits (3)
This exploit demonstrates a path traversal vulnerability in Node.js 24.x on Windows by leveraging reserved device names (e.g., AUX) to bypass path normalization. It attempts to read arbitrary files by crafting a malicious path with traverse sequences and sending it via HTTP GET or POST requests.
This PoC exploits a path traversal vulnerability in Node.js on Windows (CVE-2025-27210) by leveraging reserved device file names (e.g., AUX) combined with directory traversal sequences. It sends crafted HTTP requests to retrieve arbitrary files from the target system.
This repository contains a Python-based PoC for CVE-2025-27210, a path traversal vulnerability in Node.js on Windows. The exploit leverages reserved device names (e.g., AUX, CON) to bypass path normalization and access arbitrary files.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N