CVE-2022-25931

Directory Traversal

State: Published
Severity: 7.5 High
Published: Dec 21, 2022
Updated: Apr 16, 2025
Reserved: Feb 24, 2022

Description

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P	snyk

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
easy-static-servern/a	before unspecifiedAffected

References

https://security.snyk.io/vuln/SNYK-JS-EASYSTATICSERVER-3153539
https://github.com/cunjieliu/easyServer/blob/master/index.js%23L27
https://gist.github.com/lirantal/fdfbe26561788c8194a54bf6d31772c9

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.