Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-4vfj-c2xf-8r48
Advisory ID github_osv/GHSA-4vfj-c2xf-8r48
Aliases CVE-2017-16169
Summary Directory Traversal in looppake Affected versions of `looppake` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system. **Example request:** ```http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:foo ``` ## Recommendation No patch is available for this vulnerability. It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
System Score Found at
generic_textual HIGH
Reference id Reference type URL
https://github.com/advisories/GHSA-4vfj-c2xf-8r48
https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/looppake
https://www.npmjs.com/advisories/412
CVE-2017-16169 https://nvd.nist.gov/vuln/detail/CVE-2017-16169
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.