# express-cart path traversal vulnerability

Source: https://junglewise.ai/threats/express-cart-path-traversal-vulnerability-0acf6117  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-09-01

express-cart is a Node.js shopping cart application used to power e-commerce functionality on web storefronts. A path traversal vulnerability allows an attacker to access files outside the intended directory structure, potentially exposing sensitive configuration files, source code, or customer data stored on the server.

Technologies: [express-cart (npm)](https://junglewise.ai/threats/technologies/express-cart). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 1 September 2020.

**Which products and versions are affected?** express-cart (npm) SEMVER:introduced=0,fixed=1.1.7.

**Is there a fix for This vulnerability?** Yes. express-cart (npm): upgrade to 1.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run express-cart (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- express-cart (npm): upgrade to 1.1.7 or later

  ```sh
  npm install express-cart@1.1.7
  ```


## Technical details

This is a CWE-22 path traversal vulnerability affecting express-cart versions before 1.1.7. The vulnerability enables an attacker to use special path sequences (e.g., "../") to traverse the server's file system and access files outside the application's intended root directory. The vulnerability is remotely exploitable over the network without requiring authentication. An attacker can read arbitrary files from the server, potentially including database credentials, API keys, or customer information. The vulnerability was patched in version 1.1.7.

## Affected products

- express-cart express-cart < 1.1.7

## Timeline

- 2020-09-01: disclosed
- 2020-09-01: patched: Fixed in version 1.1.7

## References

- [https://hackerone.com/reports/343726](https://hackerone.com/reports/343726)
- [https://www.npmjs.com/advisories/676](https://www.npmjs.com/advisories/676)

## Related threats

- [express-cart admin user creation auth bypass](https://junglewise.ai/threats/cve-2018-12457-express-cart-admin-user-creation-auth-bypass)
- [express-cart unrestricted file upload vulnerability](https://junglewise.ai/threats/cve-2018-3758-express-cart-unrestricted-file-upload-vulnerability)
- [express-cart Cross-Site Request Forgery in admin](https://junglewise.ai/threats/cve-2020-22403-express-cart-cross-site-request-forgery-in-admin)
- [express-cart cross-site scripting in admin](https://junglewise.ai/threats/express-cart-cross-site-scripting-in-admin-364784a1)
- [express-cart NoSQL injection in login](https://junglewise.ai/threats/express-cart-nosql-injection-in-login-f1d83a16)