cnvd-2018-13881

EUVD-2026-167516

fkie_cve-2017-16107

pooledwebsocket is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

GHSA-cfxm-4p54-5w7h — Directory traversal in pooledwebsocket

Affected: npm: pooledwebsocket

Affected versions of `pooledwebsocket` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:** ```http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:foo ```

## Recommendation

Update to version 0.0.19 or later.

Most recent entries from all

cnvd-2018-13881

EUVD-2026-167516

fkie_cve-2017-16107

GHSA-cfxm-4p54-5w7h — Directory traversal in pooledwebsocket

gsd-2017-16107