Description
Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.
Remediation
References
https://github.com/node-red/node-red-dashboard/issues/669
https://github.com/node-red/node-red-dashboard/releases/tag/2.26.2
Related Vulnerabilities
CVE-2020-28480 Vulnerability in maven package org.webjars.npm:jointjs
CVE-2021-40865 Vulnerability in maven package org.apache.storm:storm-server
CVE-2021-45459 Vulnerability in npm package node-windows
CVE-2020-6463 Vulnerability in npm package electron
CVE-2020-21122 Vulnerability in maven package com.bstek.ureport:ureport2-console