Directory Traversal

2020-11-0303:39:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

directory traversal

validation

attacker access

system files

web root

url

EPSS

0.001

Percentile

26.1%

JSON

droppy is vulnerable to directory traversal. Lack of validation allows an attacker to access system files outside of the web root using the ../ characters in the URL.

References

github.com/silverwind/droppy/blob/master/server/server.js%23L845

github.com/silverwind/droppy/blob/v10.0.15/server/server.js#L830-L838

EPSS

0.001

Percentile

26.1%

JSON

Related for VERACODE:27733