Threats tagged 'ghsa-g3c2-rjq2-c763'

The esm.sh web.NewHandler static file server allows unauthenticated attackers to read arbitrary files outside the configured application directory by using URL-encoded dot-segment path traversal sequences such as %2e%2e. The handler joins the decoded request path directly with the application directory path without verifying that the resulting path remains within the intended directory, enabling directory traversal. This vulnerability affects versions prior to 0.2.0 and has a CVSS 3.1 score of 7.5 (high severity). A fix is available in version 0.2.0.