Executive brief
IPX is a Node.js image processing library used to handle image storage and retrieval. An incomplete path validation check allows attackers to read files outside the intended storage directory by exploiting a string prefix matching weakness, potentially exposing sensitive images or application data.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in IPX's directory validation logic. The library checks if a requested path is within allowed directories using a simple string prefix comparison without ensuring the directory path ends with a path separator. An attacker can bypass this check by requesting a path like `../public123/file.png` when the allowed directory is `./public` – because `public` is a string prefix of `public123`, the validation passes. The vulnerability is exploitable over the network with no authentication or user interaction required. An attacker can read arbitrary files from the filesystem if they share a matching prefix with the allowed directory. Patches are available in versions 1.3.2, 2.1.1, and 3.1.1.
Affected products
- unjs IPX <1.3.2, >=2.0.0-0 <2.1.1, >=3.0.0 <3.1.1
Timeline
- 2025-08-04: disclosed
- 2025-08-04: patched: Patches released: v1.3.2, v2.1.1, v3.1.1