CVE-2024-49770

npm/@oakserver/oak CVE-2024-49770: high 7.5, EPSS 0.71%

Path traversal in oak allows transfer of hidden files within the served root directory

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-qm92-93fv-vh7m
• https://github.com/oakserver/oak/security/advisories/GHSA-qm92-93fv-vh7m
• https://nvd.nist.gov/vuln/detail/CVE-2024-49770
• https://github.com/oakserver/oak/commit/4b2f27efd5cba5a45b2c3982e610da3af0869209
• https://github.com/oakserver/oak
• https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L117-L125
• https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L182C10-L182C25

CVE-2024-49770 · published 2024-11-01T21:37:10Z · modified 2024-11-01T22:27:22.350305Z · JSON