CVE-2025-59342
MEDIUM NUCLEIesm.sh < 136.1 - Path Traversal and Arbitrary File Write via X-Zone-Id Header
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-59342. PoCs published by Byte Reaper, byteReaper77. A Nuclei detection template is also available.
AI-analyzed exploit summary The exploit demonstrates a path traversal vulnerability in esm-dev version 136 by sending crafted requests to the `/transform` endpoint with various encoded payloads. It uses libcurl to perform HTTP requests and includes multiple payload variations to bypass potential filters.
Description
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Version 136.1 contains a patch.
Exploits (2)
The exploit demonstrates a path traversal vulnerability in esm-dev version 136 by sending crafted requests to the `/transform` endpoint with various encoded payloads. It uses libcurl to perform HTTP requests and includes multiple payload variations to bypass potential filters.
This repository contains a proof-of-concept exploit for CVE-2025-59342, a path traversal vulnerability in esm.sh (version 136 and earlier). The exploit leverages the `X-Zone-Id` HTTP header to perform directory traversal attacks, allowing arbitrary file writes outside the intended storage location.
Nuclei Templates (1)
http.html:"esm.sh"
References (4)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P