https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T18:02:15.909596+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2015-05902 cnvd-2015-05902 2026-10-07T18:02:15.912381+00:00 cnvd-2015-05902 https://cve.radiocsirt.org/vuln/euvd-2026-93676 EUVD-2026-93676 2026-10-07T18:02:15.912412+00:00 EUVD-2026-93676 https://cve.radiocsirt.org/vuln/fkie_cve-2015-5688 fkie_cve-2015-5688 2026-10-07T18:02:15.912426+00:00

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.

 https://cve.radiocsirt.org/vuln/ghsa-333x-9vgq-v2j4 GHSA-333x-9vgq-v2j4 — Directory Traversal in geddy 2026-10-07T18:02:15.912452+00:00

Affected: npm: geddy

Versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack via URI encoded attack vectors.

### Proof of Concept ``` http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd ```

## Recommendation

Update geddy to version >= 13.0.8

 https://cve.radiocsirt.org/vuln/gsd-2015-5688 gsd-2015-5688 2026-10-07T18:02:15.912477+00:00 gsd-2015-5688