Junglewise Threat Intelligence

CVE-2016-1000305: guard-livereload directory traversal in livereload server

CVE-2016-1000305 · Severity: medium · CVSS 6.9 · Published 2026-07-31

Executive brief

guard-livereload is a tool used by developers to automatically refresh web browsers when source files are modified. A security flaw in its internal web server allows an attacker to bypass folder restrictions and read sensitive files from the host computer. This could lead to the exposure of system configuration files, source code, or credentials if the server is accessible over a network or on a shared system.

Technical details

A directory traversal vulnerability (CWE-22) exists in guard-livereload before version 2.5.2. The livereload server component, which typically listens on port 35729, fails to properly validate file paths in incoming HTTP GET requests. An attacker can use 'dot-dot-slash' (../) sequences to escape the intended web root and access any file readable by the user running the process, such as /etc/passwd. The vulnerability is exploitable by anyone who can connect to the WebSocket/HTTP port, which may be exposed on non-local addresses or in multi-user environments. The issue was addressed in version 2.5.2 by restricting file serving to only the necessary 'livereload.js' file.

Affected products

  • guard guard-livereload < 2.5.2

Timeline

  • 2016-02-03: disclosed: Vulnerability disclosed and reported to maintainers
  • 2016-02-04: patched: Fix merged in pull request #158 and version 2.5.2 released
  • 2026-07-31: advisory: GitHub Advisory published

References