Every CVESearch/Get API key

CVE-2019-8903

Path Traversal in total.js

7.5 HighFix available

CVE-2019-8903 is a high vulnerability (CVSS 7.5) in Totaljs Total.js, published February 18, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 72.1%, the 99th percentile. Fixed in total.js 3.2.3.

What does this mean?
Severity
7.5 HighCVSS 3.0, NVD
Exploit chance
72.1%EPSS, 99th percentile
Exploitation
None known2 public exploits
Fixed in
3.2.3total.js

Description

index.js in Total.js Platform before 3.2.3 allows path traversal.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

72.1%Up 50.3 points since Apr 14, 2021
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
total.js
npm
before 3.2.3
3.2.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitTotal.js prior to 3.2.4 Directory Traversal2019-02-18
NucleiTotaljs <3.2.3 - Local File Inclusion

What each source reports

NVD Score used7.5

index.js in Total.js Platform before 3.2.3 allows path traversal.

Record
CVE-2019-8903
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE ListNo score

index.js in Total.js Platform before 3.2.3 allows path traversal.

Record
CVE-2019-8903
Updated
2026-11-02
EUVDEUVD-2019-0211No score

index.js in Total.js Platform before 3.2.3 allows path traversal.

Record
EUVD-2019-0211
Updated
2026-11-03
GitHub AdvisoriesGHSA-3q32-j57w-q4w77.5

Path Traversal in total.js

Affected versions of total.js are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files outside the /public folder by using relative paths.
The files served are limited to these file types: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml, woff, woff2, otf, ttf, eot, svg, zip, rar, pdf, docx, xlsx, doc, xls, html, htm, appcache, manifest, map, ogv, ogg, mp4, mp3, webp, webm, swf, package, json, md, m4v, jsx, heif, heic.

Recommendation

  • If you are using version 2.1.x, upgrade to 2.1.1 or later.
  • If you are using version 2.2.x, upgrade to 2.2.1 or later.
  • If you are using version 2.3.x, upgrade to 2.3.1 or later.
  • If you are using version 2.4.x, upgrade to 2.4.1 or later.
  • If you are using version 2.5.x, upgrade to 2.5.1 or later.
  • If you are using version 2.6.x, upgrade to 2.6.3 or later.
  • If you are using version 2.7.x, upgrade to 2.7.1 or later.
  • If you are using version 2.8.x, upgrade to 2.8.1 or later.
  • If you are using version 2.9.x, upgrade to 2.9.5 or later.
  • If you are using version 3.0.x, upgrade to 3.0.1 or later.
  • If you are using version 3.1.x, upgrade to 3.1.1 or later.
  • If you are using version 3.2.x, upgrade to 3.2.4 or later.
Record
GHSA-3q32-j57w-q4w7
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV7.5

index.js in Total.js Platform before 3.2.3 allows path traversal.

Record
CVE-2019-8903
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-3q32-j57w-q4w77.5

Path Traversal in total.js

Affected versions of total.js are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files outside the /public folder by using relative paths.
The files served are limited to these file types: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml, woff, woff2, otf, ttf, eot, svg, zip, rar, pdf, docx, xlsx, doc, xls, html, htm, appcache, manifest, map, ogv, ogg, mp4, mp3, webp, webm, swf, package, json, md, m4v, jsx, heif, heic.

Recommendation

  • If you are using version 2.1.x, upgrade to 2.1.1 or later.
  • If you are using version 2.2.x, upgrade to 2.2.1 or later.
  • If you are using version 2.3.x, upgrade to 2.3.1 or later.
  • If you are using version 2.4.x, upgrade to 2.4.1 or later.
  • If you are using version 2.5.x, upgrade to 2.5.1 or later.
  • If you are using version 2.6.x, upgrade to 2.6.3 or later.
  • If you are using version 2.7.x, upgrade to 2.7.1 or later.
  • If you are using version 2.8.x, upgrade to 2.8.1 or later.
  • If you are using version 2.9.x, upgrade to 2.9.5 or later.
  • If you are using version 3.0.x, upgrade to 3.0.1 or later.
  • If you are using version 3.1.x, upgrade to 3.1.1 or later.
  • If you are using version 3.2.x, upgrade to 3.2.4 or later.
Record
GHSA-3q32-j57w-q4w7
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, Metasploit, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open