Path Traversal

Overview

Versions of serve prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a /./, which allows attackers to access hidden folders and files.

Recommendation

Upgrade to version 7.0.1 or later.

References

• HackerOne Report
• GitHub Advisory