CVE-2024-56198CWE-22

path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

Critical · published December 31, 2024

CVSS v4.0
9.3
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassed using .=%5c which results in a path traversal. This vulnerability is fixed in 3.1.0.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00743 · 54.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-12-31T15:18Z
EPSS history
Timeline
  • 31 DEC 15:18Z
    path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability
    cvelistv5