Every CVE Search/ Get API key

CVE-2019-8903

Path Traversal in total.js

7.5 HighFix available

CVE-2019-8903 is a high vulnerability (CVSS 7.5) in Totaljs Total.js, published February 18, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 72.1%, the 99th percentile. Fixed in total.js 3.2.3.

index.js in Total.js Platform before 3.2.3 allows path traversal.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

72.1%Up 50.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

index.js in Total.js Platform before 3.2.3 allows path traversal.

Record
CVE-2019-8903
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

index.js in Total.js Platform before 3.2.3 allows path traversal.

Record
CVE-2019-8903
Updated
2026-11-02
EUVDEUVD-2019-0211 No score

index.js in Total.js Platform before 3.2.3 allows path traversal.

Record
EUVD-2019-0211
Updated
2026-11-03
GitHub AdvisoriesGHSA-3q32-j57w-q4w7 7.5

Path Traversal in total.js

Affected versions of total.js are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files outside the /public folder by using relative paths.
The files served are limited to these file types: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml, woff, woff2, otf, ttf, eot, svg, zip, rar, pdf, docx, xlsx, doc, xls, html, htm, appcache, manifest, map, ogv, ogg, mp4, mp3, webp, webm, swf, package, json, md, m4v, jsx, heif, heic.

Recommendation

  • If you are using version 2.1.x, upgrade to 2.1.1 or later.
  • If you are using version 2.2.x, upgrade to 2.2.1 or later.
  • If you are using version 2.3.x, upgrade to 2.3.1 or later.
  • If you are using version 2.4.x, upgrade to 2.4.1 or later.
  • If you are using version 2.5.x, upgrade to 2.5.1 or later.
  • If you are using version 2.6.x, upgrade to 2.6.3 or later.
  • If you are using version 2.7.x, upgrade to 2.7.1 or later.
  • If you are using version 2.8.x, upgrade to 2.8.1 or later.
  • If you are using version 2.9.x, upgrade to 2.9.5 or later.
  • If you are using version 3.0.x, upgrade to 3.0.1 or later.
  • If you are using version 3.1.x, upgrade to 3.1.1 or later.
  • If you are using version 3.2.x, upgrade to 3.2.4 or later.
Record
GHSA-3q32-j57w-q4w7
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 7.5

index.js in Total.js Platform before 3.2.3 allows path traversal.

Record
CVE-2019-8903
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-3q32-j57w-q4w7 7.5

Path Traversal in total.js

Affected versions of total.js are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files outside the /public folder by using relative paths.
The files served are limited to these file types: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml, woff, woff2, otf, ttf, eot, svg, zip, rar, pdf, docx, xlsx, doc, xls, html, htm, appcache, manifest, map, ogv, ogg, mp4, mp3, webp, webm, swf, package, json, md, m4v, jsx, heif, heic.

Recommendation

  • If you are using version 2.1.x, upgrade to 2.1.1 or later.
  • If you are using version 2.2.x, upgrade to 2.2.1 or later.
  • If you are using version 2.3.x, upgrade to 2.3.1 or later.
  • If you are using version 2.4.x, upgrade to 2.4.1 or later.
  • If you are using version 2.5.x, upgrade to 2.5.1 or later.
  • If you are using version 2.6.x, upgrade to 2.6.3 or later.
  • If you are using version 2.7.x, upgrade to 2.7.1 or later.
  • If you are using version 2.8.x, upgrade to 2.8.1 or later.
  • If you are using version 2.9.x, upgrade to 2.9.5 or later.
  • If you are using version 3.0.x, upgrade to 3.0.1 or later.
  • If you are using version 3.1.x, upgrade to 3.1.1 or later.
  • If you are using version 3.2.x, upgrade to 3.2.4 or later.
Record
GHSA-3q32-j57w-q4w7
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
total.js
npm
 before 3.2.3
3.2.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitTotal.js prior to 3.2.4 Directory Traversal2019-02-18
NucleiTotaljs <3.2.3 - Local File Inclusion

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, Metasploit, Nuclei, NVD, OSV

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open