Path Traversal Vulnerability in mcstatic Node Module by Node.js

CVE-2018-3730

What is CVE-2018-3730?

The mcstatic node module contains a significant path traversal vulnerability that stems from inadequate validation of the filePath input. This allows an attacker to craft a specific request to access and read contents of arbitrary files located on the server, provided they know the file's path. Such exposures can lead to disclosure of sensitive information, posing a considerable security risk for applications that utilize this module.

References