{"action":"Upgrade @saltcorn/server to 1.0.0-beta.14 or later.","affected":[{"fixed":"1.0.0-beta.14","introduced":"0"}],"component":"@saltcorn/server","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.0.0-beta.14"],"ghsa_id":"GHSA-cfqx-f43m-vfh7","id":"tcs_01M5KFJJZMPVHD1W3B6Y1J6T95","modified_at":"2024-10-03T19:46:43Z","published_at":"2024-10-03T19:46:42Z","references":["https://osv.dev/vulnerability/GHSA-cfqx-f43m-vfh7","https://github.com/saltcorn/saltcorn/security/advisories/GHSA-cfqx-f43m-vfh7","https://github.com/saltcorn/saltcorn/commit/81adaf78430a9b59804894574d67d2a0c7bb3dc5","https://github.com/saltcorn/saltcorn","https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L2884-L2893"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GHSA-cfqx-f43m-vfh7","url":"https://osv.dev/vulnerability/GHSA-cfqx-f43m-vfh7"}],"summary":"@saltcorn/server arbitrary file and directory listing when accessing build mobile app results"}