CVE-2020-15779: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path...

Path Traversal

socket.io-file is vulnerable to path traversal. The vulnerability is possible as file upload paths are generated by directly passing unsanitised user-provided name to path.join in the function socket.io-file::createFile through uploadDir and rename options...

@best/agent-hub (>=7.0.1, <=17.0.0), best (>=7.0.1, <=17.0.0) potentially affected by CVE-2020-15779 via socket.io-file (2.0.31)

socket.io-file NPM version 2.0.31 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-file and may be impacted: - @best/agent-hub =7.0.1, =7.0.1, =17.0.0 Source cves: CVE-2020-15779 Source advisory: OSV:GHSA-9H4G-27M8-QJRG...

Path Traversal in socket.io-file

All versions of socket.io-file are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The socket.io-file::createFile message contains a name option that is passed directly to path.join. It is possible to upload files to arbitrary...

GHSA-9H4G-27M8-QJRG Path Traversal in socket.io-file

All versions of socket.io-file are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The socket.io-file::createFile message contains a name option that is passed directly to path.join. It is possible to upload files to arbitrary...

PT-2020-14625

Name of the Vulnerable Software and Affected Versions socket.io-file versions through 2.0.31 Description A Path Traversal issue was discovered in the socket.io-file package for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename...

Path Traversal

Overview All versions of socket.io-file are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The socket.io-file::createFile message contains a name option that is passed directly to path.join. It is possible to upload files to...