WS-2018-0122

"Path Traversal Windows only.superstatic verifies that current dir is not evaded by checking the presense of ../ in the decoded path, but on Windows, ..\ works."...

WS-2018-0116

"All versions of superstatic are vulnerable to path traversal when used on Windows.Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize \\ to / in paths on all platforms a known example being Node.js v9.9.0."...

Directory Traversal

superstatic is vulnerable to directory traversal. Lack of validation in the file path allows a user to access to system files through the path name using the ../ characters...

Path Traversal in superstatic

Affected of superstatic are vulnerable to path traversal when used on Windows. Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize \ to / in paths on all platforms a known example being Node.js v9.9.0...

GHSA-WM77-Q74P-5763 Path Traversal in superstatic

Affected of superstatic are vulnerable to path traversal when used on Windows. Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize \ to / in paths on all platforms a known example being Node.js v9.9.0...

@partygame.show/demo (>=1.0.0-alpha.0, <=1.0.0-alpha.5), ember-superstatic (>=0.6.0, <=1.0.0) potentially affected by unknown CVE via superstatic (5.0.1)

superstatic NPM version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on superstatic and may be impacted: - @partygame.show/demo =1.0.0-alpha.0, =0.6.0, =1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-WM77-Q74P-5763...

PT-2018-19175

Name of the Vulnerable Software and Affected Versions superstatic versions prior to 5.0.2 Description The issue affects superstatic, making it vulnerable to path traversal on Windows. Additionally, on other platforms, it is vulnerable to path traversal when combined with certain Node.js versions,...

Path Traversal

Overview All versions of superstatic are vulnerable to path traversal when used on Windows. Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize \ to / in paths on all platforms a known example being Node.js v9.9.0...

Directory Traversal

superstatic is vulnerable to directory traversal. The attack exists because it does not check the decoded path has..\ which allow traversal to parent directories in Windows...

Node.js third-party modules: `superstatic` is vulnerable to path traversal on Windows

I would like to report path traversal vulnerability in superstatic It allows to read arbitrary out-of-dir files when running on the Windows platform Module module name: superstatic version: 5.0.1 npm page: https://www.npmjs.com/package/superstatic Module Description Superstatic is an enhanced...