Executive brief
byucslabsix is a Node.js library used for file serving. The package fails to properly sanitize relative file paths, allowing attackers to read arbitrary files outside the intended directory—such as sensitive configuration files or private data. This could expose confidential information stored on the affected server.
Technical details
The vulnerability is a classic directory traversal (CWE-22) in how byucslabsix resolves relative file paths. An attacker can craft requests using path traversal sequences (e.g., `GET /../../../../../../etc/passwd`) to escape the intended document root and read arbitrary files on the system. No authentication or user interaction is required; the vulnerability is remotely exploitable via network access. An attacker gains confidentiality compromise—disclosure of sensitive files such as `/etc/passwd`, configuration files, or private keys. No patch is available; the package is effectively unmitigated and unsuitable for production use.
Affected products
- <UNKNOWN> byucslabsix 0.0.5 and earlier
Timeline
- 2018-07-23: disclosed
- 2017: other: CVE-2017-16166 assigned