GHSA-gvff-25cc-4f66
Path Traversal in restify-swagger-jsdoc
Versions of restify-swagger-jsdoc prior to 3.2.1 are vulnerable to Path Traversal. The package fails to properly sanitize URLs, which may allow attackers to access server files outside the swagger-ui folder by using relative paths.
Recommendation
Upgrade to version 3.2.1 or later.
What each source reports
GitHub AdvisoriesNo score
Path Traversal in restify-swagger-jsdoc
Versions of restify-swagger-jsdoc prior to 3.2.1 are vulnerable to Path Traversal. The package fails to properly sanitize URLs, which may allow attackers to access server files outside the swagger-ui folder by using relative paths.
Recommendation
Upgrade to version 3.2.1 or later.
- Record
GHSA-gvff-25cc-4f66- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVNo score
Path Traversal in restify-swagger-jsdoc
Versions of restify-swagger-jsdoc prior to 3.2.1 are vulnerable to Path Traversal. The package fails to properly sanitize URLs, which may allow attackers to access server files outside the swagger-ui folder by using relative paths.
Recommendation
Upgrade to version 3.2.1 or later.
- Record
GHSA-gvff-25cc-4f66- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
restify-swagger-jsdocnpm | before 3.2.1 | 3.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-gvff-25cc-4f66 is a vulnerability with no CVSS score yet in restify-swagger-jsdoc, published September 3, 2020. No source lists public exploit code. Fixed in restify-swagger-jsdoc 3.2.1.