GHSA-4vvp-x9h2-x2vf Path Traversal in public
An attacker can access files outside the webroot via symlink navigation in the URL, leading to unauthorized data disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-4vvp-x9h2-x2vf?
GHSA-4vvp-x9h2-x2vf is a path traversal vulnerability in public, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of public are vulnerable to Path Traversal. This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL.
Recommendation
No fix is currently available. Do not use public in production or consider using an alternative module until a fix is made available.
Which versions are affected by GHSA-4vvp-x9h2-x2vf?
2 open source packages ship an affected version, including public.
| Package | Affected | Fixed in |
|---|---|---|
public npm | From 0.0.0 | None |
public npm | From 0.0.0 | None |
How do I fix GHSA-4vvp-x9h2-x2vf?
No fix has been published for GHSA-4vvp-x9h2-x2vf yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-4vvp-x9h2-x2vf being exploited?
There is no known exploitation of GHSA-4vvp-x9h2-x2vf in the wild and no public exploit code.