CVE-2017-14849
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change...
7.5 HighPublic exploit
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
54.4%Up 53.3 points since Apr 14, 2021
What each source reports
NVD Score used
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
- Record
CVE-2017-14849- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
- Record
CVE-2017-14849- Updated
- 2026-11-02
EUVDEUVD-2017-6338 No score
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
- Record
EUVD-2017-6338- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c5w2-4jcq-rvf5
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change...
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
- Record
GHSA-c5w2-4jcq-rvf5- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
- Record
CVE-2017-14849- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVSUSE-SU-2019:14246-1 No score
Security update for Mozilla Firefox
This update contains the Mozilla Firefox ESR 68.2 release.
Mozilla Firefox was updated to ESR 68.2 release:
-
Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.
-
Various security fixes: MFSA 2019-33 (bsc#1154738)
- CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
- CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
- CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
- CVE-2019-11759: Stack buffer overflow in HKDF output
- CVE-2019-11760: Stack buffer overflow in WebRTC networking
- CVE-2019-11761: Unintended access to a privileged JSONView object
- CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
- CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
- CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2
Other Issues resolved:
- [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
- [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
- [bsc#1043008] Firefox hangs randomly when browsing and scrolling
- [bsc#1025108] Firefox stops loading page until mouse is moved
- [bsc#905528] Firefox malfunctions due to broken omni.ja archives
- Record
SUSE-SU-2019:14246-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 68.2.0-78.51.4 | 68.2.0-78.51.4 |
MozillaFirefox-branding-SLEDSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 68-21.9.8 | 68-21.9.8 |
firefox-atkSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 2.26.1-2.8.4 | 2.26.1-2.8.4 |
firefox-cairoSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 1.15.10-2.13.4 | 1.15.10-2.13.4 |
firefox-gdk-pixbufSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 2.36.11-2.8.4 | 2.36.11-2.8.4 |
firefox-glib2SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 2.54.3-2.14.7 | 2.54.3-2.14.7 |
firefox-gtk3SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 3.10.9-2.15.3 | 3.10.9-2.15.3 |
firefox-harfbuzzSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 1.7.5-2.7.4 | 1.7.5-2.7.4 |
firefox-libffiSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 3.2.1.git259-2.3.3 | 3.2.1.git259-2.3.3 |
firefox-libffi-gcc5SUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 5.3.1+r233831-14.1 | 5.3.1+r233831-14.1 |
firefox-pangoSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 1.40.14-2.7.4 | 1.40.14-2.7.4 |
mozilla-nsprSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 4.21-29.6.1 | 4.21-29.6.1 |
mozilla-nssSUSE:Linux Enterprise Server 11 SP4-LTSS From an advisory covering 118 CVEs |
before 3.45-38.9.3 | 3.45-38.9.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | CyberCTF/vulhub-node-cve-2017-14849 | 2026-10-08 |
| Nuclei | Node.js <8.6.0 - Directory Traversal |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-14849 is a high vulnerability (CVSS 7.5) in Nodejs Node.js, published September 28, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 54.4%, the 99th percentile. No source names a fixed version.
References
nodejs.org/en/blog/vulnerability/september-2017-path-validation
securityfocus.com/bid/101056
twitter.com/nodejs/status/913131152868876288
nvd.nist.gov/vuln/detail/CVE-2017-14849
github.com/advisories/GHSA-c5w2-4jcq-rvf5
suse.com/support/update/announcement/2019/suse-su-201914246-1
Show 194 moreShow less
bugzilla.suse.com/1000036
This page doesn't list everything
Left out here: 35 references. The JSON record has them.