CVE-2018-16478 Path Traversal in simplehttpserver

Q: Which versions are affected by CVE-2018-16478?

2 open source packages ship an affected version, including simplehttpserver. It affects 1 product.

Q: Is CVE-2018-16478 being exploited?

There is no known exploitation of CVE-2018-16478 in the wild and no public exploit code.

Q: How do I fix CVE-2018-16478?

No fix has been published for CVE-2018-16478 yet. Limit exposure of the affected software until one is available.

Medium 5.3 Published 4 Dec 2018 Updated 5 Aug 2024

An attacker can list files outside the web root directory in simplehttpserver, potentially exposing sensitive file structures.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-16478?

CVE-2018-16478 is a medium-severity path traversal vulnerability in simplehttpserver, published on 4 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root.

Weakness: CWE-22

Which versions are affected by CVE-2018-16478?

2 open source packages ship an affected version, including simplehttpserver. It affects 1 product.

Package	Affected	Fixed in
`simplehttpserver` npm	All versions to `0.3.0`	None
`simplehttpserver` npm	All versions to `0.3.0`	None

Products include Simplehttpserver Project Simplehttpserver.

How do I fix CVE-2018-16478?

No fix has been published for CVE-2018-16478 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-16478 being exploited?

There is no known exploitation of CVE-2018-16478 in the wild and no public exploit code.

Sources

Also known as GHSA-vwr2-wj63-86gr.