{"id":"GHSA-f3vw-587g-r29g","aliases":[],"url":"https://o3.security/vulnerability/GHSA-f3vw-587g-r29g","summary":"Path Traversal in sapper","details":"Versions of `sapper` prior to 0.27.11 are vulnerable to Path Traversal. It is possible to access sensitive files on the server through HTTP requests containing URL-encoded `../`.  \n\nYou may test a `sapper` application running in prod mode with `curl -vvv http://localhost:3000/client/750af05c3a69ddc6073a/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd`.\n\n\n## Recommendation\n\nUpgrade to version 0.27.11 or later.","published":"2020-09-03T15:50:38Z","modified":"2020-08-31T19:01:20Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"sapper","fixedVersion":"0.27.11"}],"fix":null,"references":[{"type":"WEB","url":"https://www.npmjs.com/advisories/1494"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2020-08-31T19:01:20Z"}}