Intel

AIKIDO-2025-10640

sirv is vulnerable to Path Traversal

Path TraversalCVE-2025-58751

60

Medium Risk

This Affects:

JSsirv
0.2.5 - 3.0.1
Fixed in 3.0.2
Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to Directory Traversal due to improper path sanitization. An attacker could exploit this vulnerability by crafting a request containing relative path sequences (e.g., ../) to escape the intended serving directory. It could allow access to arbitrary files on the server's file system, potentially leading to the disclosure of sensitive information.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

sirv is vulnerable to Path Traversal in versions 0.2.5 - 3.0.1.

How to fix this

Upgrade the sirv library to the patch version.