Path Traversal

2020-07-0823:39:56

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

EPSS

0.002

Percentile

56.7%

JSON

socket.io-file is vulnerable to path traversal. The vulnerability is possible as file upload paths are generated by directly passing unsanitised user-provided name to path.join() in the function socket.io-file::createFile through uploadDir and rename options.