Executive brief
Next.js is a popular React framework for building web applications. A directory traversal vulnerability in Next.js below version 9.3.2 allows attackers with limited privileges and user interaction to access files outside the intended application directory, potentially exposing sensitive data. The issue does not affect deployments on ZEIT Now v2, serverless deployments, or static exports.
Technical details
The vulnerability is a directory traversal flaw (CWE-23) in Next.js versions below 9.3.2 that allows path manipulation to access files outside the intended directory. The attack vector is network-based and requires low privileges (authenticated user) and user interaction (UI click/action). An attacker can traverse the file system to read sensitive application or system files. The vulnerability was patched in version 9.3.2, and upgrading immediately is recommended. Notably, deployments using ZEIT Now v2 hosting, serverless target, or static export (next export) are not affected.
Affected products
- Vercel Next.js < 9.3.2
Timeline
- 2020-03-30: disclosed
- 2020-03-30: patched: Version 9.3.2