# CVE-2014-3744: st directory traversal via URL-encoded dots

Source: https://junglewise.ai/threats/cve-2014-3744-st-directory-traversal-via-url-encoded-dots  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2014-3744 · Severity: low · CVSS 3 · Published 2020-08-31

st is a Node.js module for serving static files with caching and HTTP features. Versions before 0.2.5 fail to properly decode URL-encoded dots (%2e), allowing attackers on the network to bypass path restrictions and read sensitive files directly from the server's filesystem.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2014-3744 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2014-3744 being exploited in the wild.

**How severe is CVE-2014-3744?** Low severity, with a CVSS score of 3, published 31 August 2020.

**Which products and versions are affected?** st (npm) SEMVER:introduced=0,fixed=0.2.5.

**Is there a fix for CVE-2014-3744?** Yes. st (npm): upgrade to 0.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2014-3744 attacked?** It is attacked over the network.

**Am I affected by CVE-2014-3744?** Check whether you run st (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- st (npm): upgrade to 0.2.5 or later

  ```sh
  npm install st@0.2.5
  ```


## Technical details

This is a directory traversal vulnerability (CWE-22) in st's URL path handling. The root cause is improper canonicalization of URL-encoded input: the module fails to decode %2e sequences before validating paths, allowing an attacker to craft requests like /%2e/%2e/etc/passwd that traverse the intended document root. The vulnerability requires only network access and a GET request—no authentication or user interaction is necessary. An unauthenticated remote attacker can read arbitrary files served by the application with the permissions of the st process. The fix is to upgrade to version 0.2.5 or later, which properly normalizes URL-encoded paths before path validation.

## Affected products

- isaacs st < 0.2.5

## Identifiers

- CVE-2014-3744
- GHSA-69rr-wvh9-6c4q

## Timeline

- 2014-05: disclosed: Disclosed on oss-security mailing list
- 2014: patched: Fixed in version 0.2.5
- 2020-08-31: advisory: GitHub Security Advisory published

## References

- [https://github.com/isaacs/st](https://github.com/isaacs/st)

## Related threats

- [npm st open redirect vulnerability](https://junglewise.ai/threats/cve-2017-16224-npm-st-open-redirect-vulnerability)