Description
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function in the folderCreate/createFolder.js endpoint.
Remediation
References
https://devhub.checkmarx.com/cve-details/CVE-2023-46497/
https://devhub.checkmarx.com/cve-details/Cx16846793-56b6/
Related Vulnerabilities
CVE-2023-49210 Vulnerability in npm package openssl
CVE-2018-1002204 Vulnerability in maven package org.webjars:adm-zip
CVE-2021-39148 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2020-6468 Vulnerability in npm package electron
CVE-2021-21391 Vulnerability in npm package @ckeditor/ckeditor5-font