CVE-2018-16475
Path Traversal in knightjs
A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.
- Record
CVE-2018-16475- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.
- Record
CVE-2018-16475- Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2018-0726 No score
A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.
- Record
EUVD-2018-0726- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3hvm-hgpw-rx4j
Path Traversal in knightjs
All versions of knightjs are vulnerable to Path Traversal.
This vulnerability allows an attacker to read content of arbitrary files on the server due to lack of input validation.
Recommendation
As there is currently no fix for this module we recommend not using this module in production environments.
- Record
GHSA-3hvm-hgpw-rx4j- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-3hvm-hgpw-rx4j
Path Traversal in knightjs
All versions of knightjs are vulnerable to Path Traversal.
This vulnerability allows an attacker to read content of arbitrary files on the server due to lack of input validation.
Recommendation
As there is currently no fix for this module we recommend not using this module in production environments.
- Record
GHSA-3hvm-hgpw-rx4j- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
knightjsnpm |
through 0.0.1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-16475 is a high vulnerability (CVSS 7.5) in Knight Project Knight, published November 6, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.76%, the 78th percentile. No source names a fixed version.