CVE-2025-54387: Improper Limitation of a Pathname to a Restricted Directory

IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path...

@cssninja/nuxt-media-viewer (>=0.0.1, <=0.0.15), @enab/uipkg (>=0.0.2-beta.0, <=0.0.2-beta.23) +4 more potentially affected by CVE-2025-54387 via ipx (>=1.0.0, <=1.1.0)

ipx NPM version =1.0.0, =0.0.1, =0.0.2-beta.0, =0.1.0, =1.0.0-27821548.ab054e4, =0.0.3-beta, =0.0.4 Source cves: CVE-2025-54387 Source advisory: OSV:GHSA-MM3P-J368-7JCR...

GHSA-MM3P-J368-7JCR IPX Allows Path Traversal via Prefix Matching Bypass

Summary The approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison. PoC - setup mkdir /public123 move a png file...

netlify (22.3.0), netlify-cli (>=22.2.2-pre.dd189fc, <=22.3.0) potentially affected by CVE-2025-54387 via ipx (3.0.3)

ipx NPM version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ipx and may be impacted: - netlify 22.3.0 - netlify-cli =22.2.2-pre.dd189fc, =22.3.0 Source cves: CVE-2025-54387 Source advisory: OSV:GHSA-MM3P-J368-7JCR...

@mastra/deployer-netlify (>=0.0.0-a2a-20250421213654, <=0.10.5), @rr0/cms (>=0.3.23, <=0.3.29) +14 more potentially affected by CVE-2025-54387 via ipx (>=2.0.1, <=2.1.0)

ipx NPM version =2.0.1, =0.0.0-a2a-20250421213654, =0.3.23, =1.1.6, =4.0.0, =2.0.3, =0.0.23, =1.0.0, =1.0.2, =21.5.0, =17.4.0, =0.0.7, =0.0.13 - tmp-package-registry 1.0.0 and more Source cves: CVE-2025-54387 Source advisory: OSV:GHSA-MM3P-J368-7JCR...

CVE-2022-4559

A vulnerability was found in INEX IPX-Manager up to 6.2.0. It has been declared as problematic. This vulnerability affects unknown code of the file resources/views/customer/list.foil.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version...

CVE-2022-39239

netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image domain allowlist by sending specially crafted headers, causing the handler to load and return arbitrary images. Because the response is cached globally, this...

SUSE CVE-2013-7268

The ipxrecvmsg function in net/ipx/afipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a 1 recvfrom, 2 recvmmsg, or 3 recvm...

SUSE CVE-2017-7487

The ipxitfioctl function in net/ipx/afipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service use-after-free or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface...

CVE-2022-4559

A vulnerability was found in INEX IPX-Manager up to 6.2.0. It has been declared as problematic. This vulnerability affects unknown code of the file resources/views/customer/list.foil.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version...

Cross site scripting

A vulnerability was found in INEX IPX-Manager up to 6.2.0. It has been declared as problematic. This vulnerability affects unknown code of the file resources/views/customer/list.foil.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version...

CVE-2022-4559 INEX IPX-Manager list.foil.php cross site scripting

A vulnerability was found in INEX IPX-Manager up to 6.2.0. It has been declared as problematic. This vulnerability affects unknown code of the file resources/views/customer/list.foil.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version...

CVE-2022-4559: Improper Neutralization

A vulnerability was found in INEX IPX-Manager up to 6.2.0. It has been declared as problematic. This vulnerability affects unknown code of the file resources/views/customer/list.foil.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version...

CVE-2022-4559 INEX IPX-Manager list.foil.php cross site scripting

A vulnerability was found in INEX IPX-Manager up to 6.2.0. It has been declared as problematic. This vulnerability affects unknown code of the file resources/views/customer/list.foil.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version...

PT-2022-27577 · Inex · Inex Ipx-Manager

Name of the Vulnerable Software and Affected Versions: INEX IPX-Manager versions up to 6.2.0 Description: A vulnerability was found in the file resources/views/customer/list.foil.php, which can lead to cross site scripting. The attack can be initiated remotely. Recommendations: For INEX IPX-Manag...

CVE-2022-4559 INEX IPX-Manager list.foil.php cross site scripting

A vulnerability was found in INEX IPX-Manager up to 6.2.0. It has been declared as problematic. This vulnerability affects unknown code of the file resources/views/customer/list.foil.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version...

CVE-2022-4559

INEX IPX-Manager (versions up to 6.2.0) contains a cross-site scripting vulnerability in the file resources/views/customer/list.foil.php. Exploitation is possible remotely and could impact users who visit affected pages. The issue is mitigated by upgrading to version 6.3.0, with the patch hash bc...

Cross-site Scripting (XSS)

@netlify/ipx is vulnerable to cross-site scripting.The vulnerability exists in createIPXHandler function in index.ts due to improper host validation, which allows an attacker to inject and execute malicious javascript via cache poisoning...

Design/Logic Flaw

netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image domain allowlist by sending specially crafted headers, causing the handler to load and return arbitrary images. Because the response is cached globally, this...

CVE-2022-39239

Netlify-ipx is vulnerable in versions before 1.2.3 to a cache-poisoning fault that allows an attacker to bypass the source image allowlist by sending crafted headers. This can cause the handler to load and return arbitrary images, which are then cached globally and served to visitors without requ...