Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2yh8-d2vf-hkhg
Vulnerability ID VCID-2yh8-d2vf-hkhg
Aliases CVE-2019-8903
GHSA-3q32-j57w-q4w7
Summary Path Traversal in total.js
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.53251 https://api.first.org/data/v1/epss?cve=CVE-2019-8903
epss 0.53251 https://api.first.org/data/v1/epss?cve=CVE-2019-8903
cvssv3.1 7.5 https://blog.certimetergroup.com/it/articolo/security/total.js-directory-traversal-cve-2019-8903
generic_textual HIGH https://blog.certimetergroup.com/it/articolo/security/total.js-directory-traversal-cve-2019-8903
cvssv3.1 7.5 https://github.com/advisories/GHSA-3q32-j57w-q4w7
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-3q32-j57w-q4w7
generic_textual HIGH https://github.com/advisories/GHSA-3q32-j57w-q4w7
cvssv3.1 7.5 https://github.com/totaljs/framework
generic_textual HIGH https://github.com/totaljs/framework
cvssv3.1 7.5 https://github.com/totaljs/framework/commit/c37cafbf3e379a98db71c1125533d1e8d5b5aef7
generic_textual HIGH https://github.com/totaljs/framework/commit/c37cafbf3e379a98db71c1125533d1e8d5b5aef7
cvssv3.1 7.5 https://github.com/totaljs/framework/commit/de16238d13848149f5d1dae51f54e397a525932b
generic_textual HIGH https://github.com/totaljs/framework/commit/de16238d13848149f5d1dae51f54e397a525932b
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2019-8903
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2019-8903
cvssv3.1 7.5 https://www.npmjs.com/advisories/1026
generic_textual HIGH https://www.npmjs.com/advisories/1026
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2019-8903
https://blog.certimetergroup.com/it/articolo/security/total.js-directory-traversal-cve-2019-8903
https://github.com/totaljs/framework
https://github.com/totaljs/framework/commit/c37cafbf3e379a98db71c1125533d1e8d5b5aef7
https://github.com/totaljs/framework/commit/de16238d13848149f5d1dae51f54e397a525932b
https://www.npmjs.com/advisories/1026
CVE-2019-8903 https://nvd.nist.gov/vuln/detail/CVE-2019-8903
GHSA-3q32-j57w-q4w7 https://github.com/advisories/GHSA-3q32-j57w-q4w7
Data source Metasploit
Description This module check and exploits a directory traversal vulnerability in Total.js prior to 3.2.4. Here is a list of accepted extensions: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml, woff, woff2, otf, ttf, eot, svg, zip, rar, pdf, docx, xlsx, doc, xls, html, htm, appcache, manifest, map, ogv, ogg, mp4, mp3, webp, webm, swf, package, json, md, m4v, jsx, heif, heic
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Feb. 18, 2019
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/http/totaljs_traversal.rb
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://blog.certimetergroup.com/it/articolo/security/total.js-directory-traversal-cve-2019-8903
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/advisories/GHSA-3q32-j57w-q4w7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/totaljs/framework
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/totaljs/framework/commit/c37cafbf3e379a98db71c1125533d1e8d5b5aef7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/totaljs/framework/commit/de16238d13848149f5d1dae51f54e397a525932b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-8903
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.npmjs.com/advisories/1026
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.98033
EPSS Score 0.53251
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:25:05.735273+00:00 GHSA Importer Import https://github.com/advisories/GHSA-3q32-j57w-q4w7 38.6.0