# Glance unauthorized file access via dotfile directory traversal

Source: https://junglewise.ai/threats/glance-unauthorized-file-access-via-dotfile-directory-traversal-bbde57d4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-09-02

Glance is a popular Node.js package for serving static files with built-in security features. Versions before 3.0.7 have a flaw in the --nodot option, which is designed to hide files starting with a dot (like .git and .env). The vulnerability allows attackers to bypass this protection and access hidden files stored inside dot-prefixed directories, potentially exposing sensitive configuration files and private source code.

Technologies: [glance (npm)](https://junglewise.ai/threats/technologies/glance). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 2 September 2020.

**Which products and versions are affected?** glance (npm) prior to 3.0.7.

**Is there a fix for This vulnerability?** A patch was published on 2020-09-02: Fixed in version 3.0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run glance (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authorization bypass vulnerability in the file filtering logic of the glance static file server. The --nodot option is intended to prevent directory traversal and exposure of hidden files and directories (those beginning with a dot), but the implementation only blocks access to dot-named items at the root level and fails to recursively filter contents inside dot-prefixed directories (e.g., files within .git/). An unauthenticated remote attacker can craft requests to access files inside these hidden directories, such as .git/config or other sensitive files, without requiring any special privileges or user interaction. The vulnerability affects all versions prior to 3.0.7, which introduced a fix for this filtering bypass. No CVE has been assigned.

## Affected products

- npm glance prior to 3.0.7

## Timeline

- 2020-09-02: disclosed
- 2020-09-02: patched: Fixed in version 3.0.7

## References

- [https://hackerone.com/reports/490379](https://hackerone.com/reports/490379)
- [https://www.npmjs.com/advisories/811](https://www.npmjs.com/advisories/811)

## Related threats

- [jarofghosts glance path traversal in static file server](https://junglewise.ai/threats/cve-2022-25937-jarofghosts-glance-path-traversal-in-static-file-server)
- [glance Stored Cross-Site Scripting in filename](https://junglewise.ai/threats/cve-2018-3748-glance-stored-cross-site-scripting-in-filename)
- [jarofghosts glance path traversal](https://junglewise.ai/threats/cve-2018-3715-jarofghosts-glance-path-traversal)