CVE-2017-16485

...

CVE-2017-16485

CVE-2017-16485 is rejected/not used and does not represent an active vulnerability entry.

CVE-2018-16485

CVE-2018-16485 describes a directory traversal vulnerability in the m-server Node.js module prior to version 1.4.1. The flaw arises because the server constructs targetPath with req.url using path.join and then serves the file without sanitizing the path, enabling an attacker to read arbitrary fi...