CVE-2022-25895 – Directory Traversal

https://notcve.org/view.php?id=CVE-2022-25895

All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code. Todas las versiones del paquete lite-dev-server son vulnerables a Directory Traversal debido a la falta de sanitización de entrada y al uso de entornos sandbox para la entrada del usuario req.url que se pasa al código del servidor. • https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120 https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134 https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •