Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2024-56198: path-sanitizer may let attackers access restricted files
CVE-2024-56198 · published 1 year ago
Summary
The path-sanitizer library used to clean file paths can be tricked by a special character sequence, allowing a malicious user to move outside the intended folder and read or modify files they shouldn't. This affects versions before 3.1.0 of the greencoder001/path-sanitizer package. Upgrade to version 3.1.0 or later to close the gap.
What to do
- Update greencoder001 path-sanitizer to version 3.1.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | greencoder001 | path-sanitizer |
< 3.1.0 Fix: upgrade to 3.1.0
|
Original advisory text
path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability
path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassed using .=%5c which results in a path traversal. This vulnerability is fixed in 3.1.0.
References
- https://github.com/advisories/GHSA-94p5-r7cc-3rpr
- https://www.loom.com/share/b766ece5193842848ce7562fcd559256?sid=fd826eb6-0eee-46... URL
- https://github.com/cabraviva/path-sanitizer/security/advisories/GHSA-94p5-r7cc-3... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-56198 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56198... Vendor Advisory
- https://github.com/cabraviva/path-sanitizer/commit/b6d2319eac910dffdfacc8460f5b5... Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.9
Critical
Type
CWE-22Path Traversal
Timeline
Published31 Dec 2024
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta