Description
A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path.
Remediation
References
https://github.com/advisories/GHSA-9h4g-27m8-qjrg
https://github.com/rico345100/socket.io-file
https://www.npmjs.com/advisories/1519
https://www.npmjs.com/package/socket.io-file
Related Vulnerabilities
CVE-2017-7680 Vulnerability in maven package org.apache.openmeetings:openmeetings-server
CVE-2019-15782 Vulnerability in maven package org.webjars.npm:webtorrent
CVE-2021-4245 Vulnerability in maven package org.webjars.npm:rfc6902
CVE-2018-1000174 Vulnerability in maven package org.jenkins-ci.plugins:google-login
CVE-2022-35961 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts-upgradeable