CVE-2018-3734 Path Traversal in stattic
A path traversal flaw in the stattic Node.js module allows attackers to read arbitrary files from the server filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-3734?
CVE-2018-3734 is a high-severity path traversal vulnerability in HackerOne stattic node module, published on 29 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read content of any file with known path.
Weakness: CWE-22
Which versions are affected by CVE-2018-3734?
2 open source packages ship an affected version, including stattic. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
stattic npm | All versions | 0.3.0 |
stattic npm | All versions | 0.3.0 |
Products include Stattic Project Stattic.
How do I fix CVE-2018-3734?
Upgrade stattic to 0.3.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-3734 being exploited?
There is no known exploitation of CVE-2018-3734 in the wild and no public exploit code.
Sources
Also known as GHSA-w4pv-w56c-mg4v.