# npm public path traversal via symlink navigation

Source: https://junglewise.ai/threats/npm-public-path-traversal-via-symlink-navigation-dd9ade29  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-09-03

The npm package "public" is a web file serving utility that fails to properly restrict access to files outside its intended directory. An attacker can craft URLs containing symlinks to read arbitrary files from the server's filesystem, potentially exposing sensitive data, configuration files, or application code. No patch has been released, making this a persistent risk for any production deployment.

Technologies: [npm (npm)](https://junglewise.ai/threats/technologies/npm), [public (npm)](https://junglewise.ai/threats/technologies/public). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 3 September 2020.

**Which products and versions are affected?** npm (npm) all versions; public (npm) SEMVER:introduced=0.0.0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run npm (npm) or public (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a path traversal vulnerability (CWE-22) in the npm package "public" that affects all versions from 0.0.0 onward. The root cause is inadequate symlink handling in the URL routing logic—the application resolves symbolic links without proper validation, enabling attackers to escape the webroot directory. The attack vector is network-based with no authentication or special preconditions required; an unauthenticated attacker can send crafted HTTP requests containing symlink paths to access arbitrary files on the system. The vulnerability allows complete circumvention of directory restrictions, potentially leading to unauthorized file disclosure. No fix is currently available; the advisory recommends removing the module from production use or switching to an alternative solution.

## Affected products

- npm public all versions

## Timeline

- 2020-09-03: disclosed

## References

- [https://hackerone.com/reports/593911](https://hackerone.com/reports/593911)
- [https://www.npmjs.com/advisories/1144](https://www.npmjs.com/advisories/1144)

## Related threats

- [npm cli local privilege escalation via uncontrolled module search path](https://junglewise.ai/threats/cve-2026-0775-npm-cli-local-privilege-escalation-via-uncontrolled-module-search)
- [npm pack root-level ignore file bypass in workspaces](https://junglewise.ai/threats/cve-2022-29244-npm-pack-root-level-ignore-file-bypass-in-workspaces)
- [npm incorrect permission assignment in mkdir](https://junglewise.ai/threats/cve-2018-7408-npm-incorrect-permission-assignment-in-mkdir)
- [npm Arborist symlink following on case-insensitive filesystems](https://junglewise.ai/threats/cve-2021-39134-npm-arborist-symlink-following-on-case-insensitive-filesystems)
- [npm content denial of service in HTTP header parser](https://junglewise.ai/threats/npm-content-denial-of-service-in-http-header-parser-4db9bd00)