Skip to content
OpenAdvisories
Medium · 5.3 CVE-2018-3718 EUVD-2021-1580GHSA-5rc4-8qqh-vq7f

vercel/serve allows access to restricted files if filename is URL encoded.

Published Jun 7, 2018 · Updated Sep 16, 2024 · Assigned by hackerone

Vendor: HackerOne Product: serve node module Package: serve Ecosystem: npm

Description

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.

Affected products

VendorProductAffectedFixed
HackerOne serve node module All versions —

Affected packages

EcosystemPackageAffectedFixedRecord
npm serve < 6.5.2 6.5.2 GHSA-5rc4-8qqh-vq7f

References