Directory traversal

simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16132

CVE-2017-16132 concerns simple-npm-registry, a local npm package cache. Multiple connected sources confirm a directory traversal vulnerability in simple-npm-registry: an attacker can craft a URL containing relative path sequences (e.g., ../../) to access files outside the intended directory root....