CVE-2022-25931

🗓️ 21 Dec 2022 01:21:43Reported by snykType

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2022-25931	20 Dec 202207:11	–	circl
CNNVD	easy-static-server 路径遍历漏洞	20 Dec 202200:00	–	cnnvd
Cvelist	CVE-2022-25931 Directory Traversal	21 Dec 202201:21	–	cvelist
EUVD	EUVD-2022-7760	3 Oct 202520:07	–	euvd
Github Security Blog	easy-static-server vulnerable to Directory Traversal	20 Dec 202206:30	–	github
NVD	CVE-2022-25931	20 Dec 202205:15	–	nvd
OSV	GHSA-WCWM-C3MR-PXCR easy-static-server vulnerable to Directory Traversal	20 Dec 202206:30	–	osv
Prion	Directory traversal	20 Dec 202205:15	–	prion
Snyk	Directory Traversal	5 Dec 202213:20	–	snyk
Veracode	Directory Traversal	21 Dec 202202:29	–	veracode

NVD

Node

easy-static-server_project easy-static-servernode.js

[
  {
    "vendor": "n/a",
    "product": "easy-static-server",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
gist	www.gist.github.com/lirantal/fdfbe26561788c8194a54bf6d31772c9
github	www.github.com/cunjieliu/easyServer/blob/master/index.js%23L27
security	www.security.snyk.io/vuln/SNYK-JS-EASYSTATICSERVER-3153539

16 Apr 2025 18:15Current

7.5High risk

Vulners AI Score7.5

CVSS 3.17.5

EPSS0.01475

SSVC

CWE-22