CVE-2023-26152 HIGH

CVE-2023-26152

Vendor N/A

Product static-server

Weakness CWE-22 · Path traversal

Published October 3, 2023

Last update September 23, 2024

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P

What the vulnerability does

01Description

All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server.js.

Key dates

02Disclosure timeline

October 3, 2023 CVE published

September 23, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-26152 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html

Related vulnerabilities

04Related CVE

CVE-2023-40509 LG Simple Editor deleteCanvas Directory Traversal Arbitrary File Deletion Vulnerability CVE-2022-2893 CVE-2026-11470 hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal CVE-2020-36647 YunoHost-Apps transmission_ynh nginx.conf path traversal CVE-2026-40180 Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class