better-helperjs versions <= 3.0.5 contain a directory traversal vulnerability in the production static file server. The vulnerability is due to the use of String.prototype.startsWith() to validate requested paths against the static root directory, which is insufficient because it only checks string prefixes rather than actual directory boundaries. An attacker can exploit this by requesting files in adjacent directories whose names start with the static root directory's prefix, bypassing the validation and reading arbitrary files. The flaw is corrected in version 3.0.6 by requiring the resolved path to start with the root directory plus a path separator or be exactly the root directory, preventing prefix-based bypasses.

An attacker can read arbitrary files located in directories adjacent to the static root directory if those directories share the same string prefix as the root. This leads to unauthorized disclosure of potentially sensitive information. The vulnerability has a CVSS 3.1 base score of 7.5 (High) with network attack vector, no privileges required, and no user interaction needed. There is no impact on integrity or availability.

An official patch is available in better-helperjs version 3.0.6 and later, which fixes the path validation logic to prevent prefix-based directory traversal. Users should upgrade to version 3.0.6 or newer. If upgrading is not immediately possible, users should ensure that no sensitive directories with names sharing the static root directory's prefix are deployed adjacent to the static files directory to mitigate the risk.