# CVE-2018-16485: m-server directory traversal

Source: https://junglewise.ai/threats/cve-2018-16485-m-server-directory-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-02-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-16485 · Severity: low · CVSS 3 · Published 2019-02-18

m-server is a Node.js utility for serving files and content from a local directory. An authenticated attacker can exploit a path traversal vulnerability to read arbitrary files from the server by manipulating URL requests with path sequences, potentially exposing sensitive system files or application data. This could lead to unauthorized disclosure of confidential information stored on the affected server.

Technologies: [m-server (npm)](https://junglewise.ai/threats/technologies/m-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-16485 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-16485 being exploited in the wild.

**How severe is CVE-2018-16485?** Low severity, with a CVSS score of 3, published 18 February 2019.

**Which products and versions are affected?** m-server (npm) <1.4.1.

**Is there a fix for CVE-2018-16485?** A patch was published on 2019-02-18: Version 1.4.1 contains the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-16485 attacked?** It is attacked over the network.

**Am I affected by CVE-2018-16485?** Check whether you run m-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a classic path traversal (CWE-22) flaw in m-server versions prior to 1.4.1, where insufficient input validation on URL paths allows an attacker to escape the intended directory root. An authenticated user can append path traversal sequences (such as slashes) to URL requests to access arbitrary files in the directory tree, including sensitive system files like /etc/passwd. The attack requires user authentication and network access to the m-server instance, and allows reading of file contents without modification or availability impact. The issue was fixed in version 1.4.1.

## Affected products

- npm m-server <1.4.1

## Identifiers

- CVE-2018-16485
- GHSA-899g-6q6w-7v94

## Timeline

- 2019-02-18: disclosed
- 2019-02-18: patched: Version 1.4.1 contains the fix

## References

- [https://hackerone.com/reports/319795](https://hackerone.com/reports/319795)

## Related threats

- [m-server path traversal in file serving](https://junglewise.ai/threats/m-server-path-traversal-in-file-serving-2e1cddbd)
- [m-server cross-site scripting in file naming](https://junglewise.ai/threats/cve-2018-16484-m-server-cross-site-scripting-in-file-naming)