Executive brief
path-sanitizer is an npm library used to validate and filter file paths to prevent unauthorized directory access in applications. The library's filters can be bypassed using specially crafted input (such as encoded backslash sequences), allowing attackers to read or access files outside the intended directory—potentially exposing sensitive system files or application data.
Technical details
This vulnerability is a path traversal (CWE-22) flaw in the path-sanitizer npm package that fails to properly sanitize user-supplied path input. Attackers can bypass the existing filters using payloads like "..=%5c" (URL-encoded backslash followed by parent directory traversal sequences) to escape the intended application directory. The vulnerability is triggered when user-controlled path data is passed to the sanitize() function and then joined with a base directory, allowing access to arbitrary files on the filesystem. The attack is network-accessible if the library is used in a web application context, and no authentication or special preconditions are required. A patch was released in version 3.1.0; all versions prior to that are vulnerable.
Affected products
- cabraviva path-sanitizer < 3.1.0
Timeline
- 2024-12-31: disclosed: Published on GitHub Security Advisory
- 2025-01-02: advisory: Published on OSV/NVD
- 2024-12-31: patched: Fix released in version 3.1.0