CVE-2022-25848

This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.96% chance of exploitation in the next 30 days, 59th percentile

Published

2022-11-29

Updated

2025-04-24

Proof-of-concept exploits (2)

• https://gist.github.com/lirantal/5550bcd0bdf92c1b56fbb20e141fe5bd
• https://security.snyk.io/vuln/SNYK-JS-STATICDEVSERVER-3149917

References

• CVE Record
• NVD entry

Related

• CVE-2022-25847
• CVE-2022-25849
• CVE-2022-25845
• CVE-2022-2585
• CVE-2022-25844
• CVE-2022-25850