Executive brief
better-helperjs is a full-stack TypeScript web framework used to build applications with server-side rendering and static file serving. A vulnerability in the production static file server allows attackers to read sensitive files located in adjacent directories that share a similar name prefix as the public directory, bypassing intended security restrictions. An attacker can exploit this remotely without authentication to access database files, secrets, or other confidential data.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in the safeStaticPath() method of src/ssr/site-server.ts. The validation logic uses String.prototype.startsWith() to check if a resolved file path is within the intended static root directory. However, this is flawed because startsWith() evaluates strings as plain text rather than as directory structures. For example, if the root is /app/dist/client, an attacker can access /app/dist/client-secrets/database.sqlite because the string "/app/dist/client-secrets/database.sqlite" technically starts with "/app/dist/client". The attack vector is network-based with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The vulnerability only affects production deployments (NODE_ENV=production); development mode is protected by Vite's defensive middleware. The fix enforces path.sep to mandate exact directory boundaries: resolved.startsWith(root + path.sep) || resolved === root.
Affected products
- Rigby-Foundation better-helperjs <= 3.0.5
Timeline
- 2026-06-26: disclosed
- 2026-06-26: patched: Fixed in version 3.0.6