# CVE-2026-116673: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

Source: https://junglewise.ai/threats/cve-2026-116673-systeminformation-is-a-system-and-os-information-library-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116673 · Severity: low · CVSS 3.3 · Published 2026-10-27

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.

Technologies: [systeminformation (npm)](https://junglewise.ai/threats/technologies/systeminformation). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-116673 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116673 being exploited in the wild.

**How severe is CVE-2026-116673?** Low severity, with a CVSS score of 3.3, published 27 October 2026.

**Which products and versions are affected?** systeminformation (npm) < 5.33.14, SEMVER:introduced=0,fixed=5.33.14.

**Is there a fix for CVE-2026-116673?** Yes. systeminformation (npm): upgrade to 5.33.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-116673?** Check whether you run systeminformation (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- systeminformation (npm): upgrade to 5.33.14 or later

  ```sh
  npm install systeminformation@5.33.14
  ```


## Affected products

- systeminformation (npm) < 5.33.14, SEMVER:introduced=0,fixed=5.33.14

## Identifiers

- CVE-2026-116673
- GHSA-4vjg-vx72-qq4g

## Related threats

- [systeminformation prototype pollution in networkStats](https://junglewise.ai/threats/cve-2026-116674-systeminformation-is-a-system-and-os-information-library-for)
- [systeminformation PowerShell command injection via Unicode quotation marks](https://junglewise.ai/threats/cve-2026-116576-systeminformation-is-a-system-and-os-information-library-for)
- [sebhildebrandt systeminformation OS command injection in networkInterfaces](https://junglewise.ai/threats/cve-2026-50289-sebhildebrandt-systeminformation-os-command-injection-in)
- [sebhildebrandt systeminformation command injection in networkInterfaces](https://junglewise.ai/threats/cve-2026-44724-sebhildebrandt-systeminformation-command-injection-in)
- [sebhildebrandt systeminformation command injection in versions function](https://junglewise.ai/threats/cve-2026-26318-sebhildebrandt-systeminformation-command-injection-in-versions)