CVE-2022-25931 – Directory Traversal

https://notcve.org/view.php?id=CVE-2022-25931

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code. Todas las versiones del paquete easy-static-server son vulnerables a Directory Traversal debido a la falta de sanitización de entrada y al uso de entornos sandbox para la entrada del usuario req.url que se pasa al código del servidor. • https://gist.github.com/lirantal/fdfbe26561788c8194a54bf6d31772c9 https://github.com/cunjieliu/easyServer/blob/master/index.js%23L27 https://security.snyk.io/vuln/SNYK-JS-EASYSTATICSERVER-3153539 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •