CVE-2025-27210

This exploit demonstrates a path traversal vulnerability in Node.js 24.x on Windows by leveraging reserved device names (e.g., AUX) to bypass path normalization. It attempts to read arbitrary files by crafting a malicious path with traverse sequences and sending it via HTTP GET or POST requests.

This PoC exploits a path traversal vulnerability in Node.js on Windows (CVE-2025-27210) by leveraging reserved device file names (e.g., AUX) combined with directory traversal sequences. It sends crafted HTTP requests to retrieve arbitrary files from the target system.

This repository contains a Python-based PoC for CVE-2025-27210, a path traversal vulnerability in Node.js on Windows. The exploit leverages reserved device names (e.g., AUX, CON) to bypass path normalization and access arbitrary files.