{"id":"CVE-2018-3718","aliases":["GHSA-5rc4-8qqh-vq7f"],"url":"https://o3.security/vulnerability/CVE-2018-3718","summary":"vercel/serve allows access to restricted files if filename is URL encoded.","details":"serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.","published":"2018-06-07T02:29:08.190Z","modified":"2026-08-27T08:18:51.005127Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"serve","fixedVersion":"6.5.2"}],"fix":null,"references":[{"type":"FIX","url":"https://hackerone.com/reports/308721"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T08:18:51.005127Z"}}