A directory traversal vulnerability exists in better-helperjs static file server versions up to 3.0.5. The vulnerability arises from improper path validation using string prefix checks, allowing attackers to access files in adjacent directories with names sharing the static root directory's prefix. This flaw enables unauthorized reading of sensitive files outside the intended public directory. The issue is fixed in version 3.0.6 by enforcing exact path boundary checks. No known exploits are reported in the wild.