CVE-2017-14849 | BDVDB-2026-91025 Detail

Description#

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/
http://www.securityfocus.com/bid/101056
https://twitter.com/nodejs/status/913131152868876288

Exploit#

No public exploit known

History#

Version 12017-09-28Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.