A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2020-07-15T20:42:39
Updated: 2024-08-04T13:22:30.824Z
Reserved: 2020-07-15T00:00:00
Link: CVE-2020-15779
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2020-07-15T21:15:12.537
Modified: 2020-07-22T17:06:55.403
Link: CVE-2020-15779
Redhat
No data.