book-cli (1.2.0) potentially affected by CVE-2017-16152 via static-html-server (0.1.2)

static-html-server NPM version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on static-html-server and may be impacted: - book-cli 1.2.0 Source cves: CVE-2017-16152 Source advisory: OSV:GHSA-9J5M-873F-XH76...

CVE-2017-16152

CVE-2017-16152 affects the static-html-server static file server. The connected documents describe a directory traversal vulnerability triggered by URL paths containing ../, which can allow an attacker to access files outside the intended directory root and disclose private files. PoC examples ar...