# CVE-2018-16493: simplehttpserver path traversal

Source: https://junglewise.ai/threats/cve-2018-16493-simplehttpserver-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-02-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-16493 · Severity: info · CVSS 7.5 · Published 2019-02-07

simplehttpserver is a Node.js-based HTTP server library used to serve static files. Due to improper path validation, an attacker can use relative path sequences (e.g., "../") to read files outside the intended directory, potentially exposing sensitive configuration files, source code, or other confidential data stored on the server. This bypasses intended access restrictions and can lead to information disclosure.

Technologies: [simplehttpserver (npm)](https://junglewise.ai/threats/technologies/simplehttpserver). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-16493 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-16493 being exploited in the wild.

**How severe is CVE-2018-16493?** Informational severity, with a CVSS score of 7.5, published 7 February 2019.

**Which products and versions are affected?** simplehttpserver (npm) <0.2.1; static-resource-server (npm) <=1.7.2.

**Is there a fix for CVE-2018-16493?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2018-16493 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-16493?** Check whether you run simplehttpserver (npm) or static-resource-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal (directory traversal) flaw caused by insufficient input sanitization on file paths. When processing HTTP requests, the server fails to properly validate or normalize user-supplied paths, allowing attackers to craft requests using relative path components (such as "../") to escape the intended document root and access arbitrary files on the filesystem. The attack is network-accessible with no authentication required; a simple HTTP GET request with a crafted path is sufficient. An attacker can read any file accessible to the server process, including configuration files, private keys, or source code. The fix is to upgrade to version 0.2.1 or later, which should implement proper path canonicalization and validation.

## Affected products

- npm simplehttpserver <0.2.1
- npm static-resource-server <=1.7.2

## Identifiers

- CVE-2018-16493
- GHSA-45j8-pm75-5v8x

## Timeline

- 2019-02-07: disclosed

## References

- [https://hackerone.com/reports/357109](https://hackerone.com/reports/357109)
- [https://hackerone.com/reports/432600](https://hackerone.com/reports/432600)
- [https://www.npmjs.com/advisories/967](https://www.npmjs.com/advisories/967)
- [https://www.npmjs.com/advisories/968](https://www.npmjs.com/advisories/968)

## Related threats

- [simplehttpserver path traversal via symlink navigation](https://junglewise.ai/threats/cve-2018-16478-simplehttpserver-path-traversal-via-symlink-navigation)
- [simplehttpserver directory traversal and file listing](https://junglewise.ai/threats/cve-2018-3787-simplehttpserver-directory-traversal-and-file-listing)
- [simplehttpserver stored cross-site scripting](https://junglewise.ai/threats/cve-2018-3716-simplehttpserver-stored-cross-site-scripting)