# visionmedia send path traversal vulnerability

Source: https://junglewise.ai/threats/visionmedia-send-path-traversal-vulnerability-279606be  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-10-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2018-10-09

The visionmedia send library is a Node.js utility for serving files over HTTP. A flaw in its directory validation logic allows attackers to access restricted directories outside the intended document root by exploiting partial string matching (e.g., accessing "public-restricted" when "public" should be the boundary). This could expose sensitive files to unauthorized access.

Technologies: [Send](https://junglewise.ai/threats/technologies/npm-send).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 9 October 2018.

**Which products and versions are affected?** Send SEMVER:introduced=0,fixed=0.8.4.

**Is there a fix for This vulnerability?** Yes. Send: upgrade to 0.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Send at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Send: upgrade to 0.8.4 or later

## Technical details

The vulnerability is a path traversal issue in visionmedia send versions before 0.8.4, stemming from incomplete directory boundary validation logic. The library uses a partial comparison rather than strict path validation when checking whether a requested directory lies within the configured document root. An unauthenticated remote attacker can bypass this check over the network by crafting requests targeting directories with names that share a common prefix (e.g., "public-restricted" bypasses a check for "public" as root). The attacker achieves unauthorized file access to restricted directories. The vulnerability was patched in version 0.8.4.

## Affected products

- visionmedia send before 0.8.4

## Timeline

- 2018-10-09: disclosed
- 2018-10-09: patched: Fixed in version 0.8.4

## Related threats

- [send template injection leading to XSS](https://junglewise.ai/threats/cve-2024-43799-send-template-injection-leading-to-xss)
- [send directory traversal vulnerability](https://junglewise.ai/threats/cve-2014-6394-send-directory-traversal-vulnerability)
- [send package for Node.js path disclosure](https://junglewise.ai/threats/cve-2015-8859-send-package-for-node-js-path-disclosure)