CVE-2022-25895

Directory Traversal

State: Published
Severity: 7.5 High
Published: Dec 21, 2022
Updated: Apr 16, 2025
Reserved: Feb 24, 2022

Description

All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P	snyk

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
lite-dev-servern/a	before unspecifiedAffected

References

https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718
https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134
https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.