CVE-2015-8859

Root Path Disclosure in send

5.3 MediumFix available

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

4.70%Up 3.7 points since Feb 4, 2022

What each source reports

NVD Score used 5.3

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Record: CVE-2015-8859
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Updated: 2026-11-02

CVE List No score

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Record: CVE-2015-8859
Updated: 2026-11-02

EUVDEUVD-2017-0261 No score

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Record: EUVD-2017-0261
Updated: 2026-11-02

GitHub AdvisoriesGHSA-jgqf-hwc5-hh37 5.3

Root Path Disclosure in send

Versions of send prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.

Recommendation

Update to version 0.11.1 or later.

Record: GHSA-jgqf-hwc5-hh37
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVAZL-45024 5.3

CVE-2015-8859 affecting package nodejs-nodemon 2.0.3-5

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Record: AZL-45024
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-05

OSV 5.3

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Record: CVE-2015-8859
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

Show 8 moreShow less

OSVDEBIAN-CVE-2015-8859 5.3

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Record: DEBIAN-CVE-2015-8859
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVGHSA-jgqf-hwc5-hh37 5.3

Root Path Disclosure in send

Versions of send prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.

Recommendation

Update to version 0.11.1 or later.

Record: GHSA-jgqf-hwc5-hh37
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-8859 5.3

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Record: UBUNTU-CVE-2015-8859
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVCLSA-2026-1789377909 No score

TuxCare security update for send (2 CVEs)

TuxCare rebuilt send to address 2 CVEs. Fixed in 0.0.4-tuxcare.1.

Record: CLSA-2026-1789377909
Updated: 2026-11-02

OSVCLSA-2026-1791843631 No score

TuxCare security update for send (3 CVEs)

TuxCare rebuilt send to address 3 CVEs. Fixed in 0.1.0-tuxcare.1.

Record: CLSA-2026-1791843631
Updated: 2026-11-02

OSVCLSA-2026-1792151921 No score

TuxCare security update for send (1 CVE)

TuxCare rebuilt send to address 1 CVE. Fixed in 0.1.1-tuxcare.1.

Record: CLSA-2026-1792151921
Updated: 2026-11-02

OSVCLSA-2026-1792496437 No score

TuxCare security update for send (3 CVEs)

TuxCare rebuilt send to address 3 CVEs. Fixed in 0.7.4-tuxcare.1.

Record: CLSA-2026-1792496437
Updated: 2026-11-02

OSVCLSA-2026-1793292510 No score

TuxCare security update for send (3 CVEs)

TuxCare rebuilt send to address 3 CVEs. Fixed in 0.1.4-tuxcare.1.

Record: CLSA-2026-1793292510
Updated: 2026-11-02

Affected products

send project send

Affected packages

Affected packages
Package	Affected	Fixed
`send` npm	before 0.11.1	0.11.1
`nodejs-nodemon` Azure Linux:3	through 2.0.3-5	None known
`send` TuxCare:npm From an advisory covering 2 CVEs	0.0.4-tuxcare.0 up to 0.0.4-tuxcare.1, plus listed versions 0.0.4	0.0.4-tuxcare.1
`send` TuxCare:npm From an advisory covering 3 CVEs	0.1.0-tuxcare.0 up to 0.1.0-tuxcare.1, plus listed versions 0.1.0	0.1.0-tuxcare.1
`send` TuxCare:npm	0.1.1-tuxcare.0 up to 0.1.1-tuxcare.1, plus listed versions 0.1.1	0.1.1-tuxcare.1
`send` TuxCare:npm From an advisory covering 3 CVEs	0.7.4-tuxcare.0 up to 0.7.4-tuxcare.1, plus listed versions 0.7.4	0.7.4-tuxcare.1
`send` TuxCare:npm From an advisory covering 3 CVEs	0.1.4-tuxcare.0 up to 0.1.4-tuxcare.1, plus listed versions 0.1.4	0.1.4-tuxcare.1
`node-send` Debian:12	before 0.16.2-1	0.16.2-1
`node-send` Debian:13	before 0.16.2-1	0.16.2-1
`node-send` Debian:14	before 0.16.2-1	0.16.2-1
`node-send` Ubuntu:16.04:LTS	All versions, plus listed versions 0.9.4-1	None known
`node-send` Ubuntu:18.04:LTS	All versions, plus listed versions 0.9.4-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-8859 is a medium vulnerability (CVSS 5.3) in Send Project Send, published January 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.70%, the 91st percentile. Fixed in send 0.11.1.

References

Show 7 moreShow less