105 matches found
Improper Handling of URL Encoding (Hex Encoding)
Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Improper Handling of URL Encoding Hex Encoding via inconsistent URL decoding between the serveStatic process and route-based middleware protections. An attacker can access protected static...
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
Summary When using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes %2F may be...
GHSA-WC8C-QW6V-H7F6 @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
Summary When using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes %2F may be...
Hono vulnerable to arbitrary file access via serveStatic vulnerability
Summary When using serveStatic together with route-based middleware protections e.g. app.use'/admin/', ..., inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowe...
GHSA-Q5QW-H33P-QVWR Hono vulnerable to arbitrary file access via serveStatic vulnerability
Summary When using serveStatic together with route-based middleware protections e.g. app.use'/admin/', ..., inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowe...
Hono 安全漏洞
Hono is a web framework written in TypeScript for the Hono community. Versions of Hono prior to 4.12.4 contained security vulnerabilities. These vulnerabilities stemmed from inconsistent URL decoding when using serveStatic and routing-based middleware protections. This allowed paths containing...
PT-2026-23075
Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.4 Description Hono is a Web application framework supporting various JavaScript runtimes. An inconsistency in URL decoding between the router decodeURI and serveStatic decodeURIComponent allowed protected static...
CVE-2025-11563
A flaw was found in wcurl. This vulnerability allows a remote attacker to manipulate the location where output files are saved. By crafting a malicious URL with percent-encoded slashes, the attacker can trick the wcurl command-line tool into writing files outside of the intended directory. This...
EUVD-2025-208109
URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the handling of URLs containing percent-encoded slashes in the UNSAFEPERCENTENCODE parameter in wcurl wrapper. An attacker can cause files to be saved outside of the intended directory by supplying specially...
CVE-2025-11563
URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool...
UBUNTU-CVE-2025-11563
URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool...
CVE-2025-11563
URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool...
CVE-2025-11563 wcurl path traversal with percent-encoded slashes
URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool...
CVE-2025-11563
CVE-2025-11563 describes a wcurl path-traversal issue where URLs with percent-encoded slashes can cause output to be saved outside the intended directory. The connected advisories (Ubuntu USN-8062-1, Amazon Linux ALAS2025-3088/ALAS2023-2025-1317, and related Nessus/NVD/NVL entries) corroborate th...
CVE-2025-11563
URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool...
CVE-2025-11563 wcurl path traversal with percent-encoded slashes
URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool...
CVE-2025-11563 wcurl path traversal with percent-encoded slashes
URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool...
Server-Side Request Forgery (SSRF)
Apache HTTP Server is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper handling of encoded and merged slashes when AllowEncodedSlashes is enabled and MergeSlashes is disabled on Windows, which allows an attacker to exploit crafted requests or malicious content ...