# CVE-2018-3715: jarofghosts glance path traversal

Source: https://junglewise.ai/threats/cve-2018-3715-jarofghosts-glance-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-26. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2018-3715 · Severity: low · CVSS 3.1 · Published 2018-07-26

The glance Node.js module, a tool used for serving files, contains a security flaw that allows unauthorized access to files on the host system. By exploiting this vulnerability, an attacker can bypass directory restrictions to read sensitive files, such as configuration data or system credentials, provided they know the file path. This could lead to the exposure of private company data or system-level information.

Technologies: [glance (npm)](https://junglewise.ai/threats/technologies/glance). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-3715 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-3715 being exploited in the wild.

**How severe is CVE-2018-3715?** Low severity, with a CVSS score of 3.1, published 26 July 2018.

**Which products and versions are affected?** glance (npm) SEMVER:introduced=0,fixed=3.0.4.

**Is there a fix for CVE-2018-3715?** Yes. glance (npm): upgrade to 3.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-3715 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-3715?** Check whether you run glance (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- glance (npm): upgrade to 3.0.4 or later

  ```sh
  npm install glance@3.0.4
  ```


## Technical details

A path traversal vulnerability (CWE-22) exists in the glance npm package prior to version 3.0.4. The vulnerability is caused by a lack of proper validation for user-supplied input used to construct file paths. An attacker with network access and low-level privileges can provide specially crafted paths (e.g., using dot-dot-slash sequences) to escape the intended directory and read any file on the filesystem that the Node.js process has permissions to access. The issue was addressed in version 3.0.4 by implementing path validation.

## Affected products

- jarofghosts glance < 3.0.4

## Identifiers

- CVE-2018-3715
- GHSA-2x4q-6jfv-8h9h

## Timeline

- 2018-06-06: disclosed: NVD Published Date
- 2018-07-26: advisory: GitHub Advisory published
- 2018-05-30: patched: Fix committed to repository

## References

- [https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19](https://github.com/jarofghosts/glance/commit/8cfd88e44ebd3f07e3a2eaf376a3e758b6c4ca19)
- [https://hackerone.com/reports/310106](https://hackerone.com/reports/310106)
- [https://www.npmjs.com/advisories/590](https://www.npmjs.com/advisories/590)

## Related threats

- [jarofghosts glance path traversal in static file server](https://junglewise.ai/threats/cve-2022-25937-jarofghosts-glance-path-traversal-in-static-file-server)
- [Glance unauthorized file access via dotfile directory traversal](https://junglewise.ai/threats/glance-unauthorized-file-access-via-dotfile-directory-traversal-bbde57d4)
- [glance Stored Cross-Site Scripting in filename](https://junglewise.ai/threats/cve-2018-3748-glance-stored-cross-site-scripting-in-filename)