Root Path Disclosure

Overview

Versions of send prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.

Recommendation

Update to version 0.11.1 or later.

References

• PR #70
• Express Changelog - 2015/01/20
• GitHub Advisory