Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2018-3712: Serve Node Module Allows Malicious Access to Directory Contents
CVE-2018-3712 · published 8 years ago
Summary
The Serve Node module is not properly validating directory paths, which means a malicious user could potentially access the contents of any directory they know about. This could allow them to view sensitive information they shouldn't be able to see. Update the Serve Node module to version 6.4.9 or later to fix this issue.
What to do
- Update vercel-release-bot serve to version 6.4.9.
- Update zeit serve to version 6.4.9 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | vercel-release-bot | serve |
<= 6.4.8 Fix: upgrade to 6.4.9
|
| – | zeit | serve |
< 6.4.9 cpe:2.3:a:zeit:serve:*:*:*:*:*:node.js:*:* |
Original advisory text
serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a malicious user to view the contents of ...
serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a malicious user to view the contents of any directory with known path.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-22Path Traversal
Timeline
Published7 Jun 2018
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta