Threats tagged 'ghsa-2cj2-3364-qxxf'

A path traversal vulnerability exists in all versions of mustafaakin/cast-localvideo. An unauthenticated remote attacker can exploit this flaw to read arbitrary files on the server by supplying a crafted directory path to the vulnerable handler in app.js. This occurs because the user input is passed directly to res.sendFile() without proper sanitization, allowing directory traversal sequences such as ../ to access sensitive files.