esm.sh server path traversal allows arbitrary file read
Files on self-hosted esm.sh servers can be peeked at from outside.
Summary
Encoded dot segments in the static file server of esm.sh bypass path checks, letting a remote attacker read files outside the app directory. The attacker needs no login, and server versions before 137_7 are affected.
Affected when
- web.NewHandler static file server in use
What to do
Update to server version 137_7 or newer.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen