{"id":"CVE-2014-10068","aliases":["EUVD-2020-0621","GHSA-g4xp-36c3-f7mr"],"status":"published","title":"Hidden Directories Always Served in inert","description":"The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01891,"percentile":0.79716,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2018-05-29T20:00:00Z","modified":"2026-06-17T00:04:10Z","fixes":[{"ecosystem":"npm","package":"inert","fixed_in":["1.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"inert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"inert","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]}],"products":[{"vendor":"hackerone","product":"inert node module"},{"vendor":"hapi","product":"inert"}],"references":[{"url":"https://github.com/hapijs/inert/pull/15","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://github.com/hapijs/inert/commit/e8f99f94da4cb08e8032eda984761c3f111e3e82","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://nodesecurity.io/advisories/14","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory"]},{"url":"https://www.npmjs.com/advisories/14","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-10068","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g4xp-36c3-f7mr"}],"sources":{"cve":[{"id":"CVE-2014-10068","description":"The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.","status":"published","published":"2018-05-29T20:00:00Z","modified":"2024-09-17T03:12:54.633Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:42.219637Z"}],"euvd":[{"id":"EUVD-2020-0621","description":"The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.","status":"published","published":"2018-05-29T20:00:00Z","modified":"2024-09-17T03:12:54Z","updated_at":"2026-11-03T00:28:33.76418Z"}],"ghsa":[{"id":"GHSA-g4xp-36c3-f7mr","title":"Hidden Directories Always Served in inert","description":"Versions 1.1.1 and earlier of `inert` are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false.\n\nThe inert directory handler always allows files in hidden directories to be served, even when `showHidden` is false.\n\n\n## Recommendation\n\nUpdate to version \u003e= 1.1.1.","status":"published","published":"2020-08-31T22:47:41Z","modified":"2023-01-09T05:03:33Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:05.705235Z"}],"nvd":[{"id":"CVE-2014-10068","description":"The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.","status":"published","published":"2018-05-29T20:29:00.283Z","modified":"2026-06-17T00:04:10.833Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:02:59.001778Z"}],"osv":[{"id":"GHSA-g4xp-36c3-f7mr","title":"Hidden Directories Always Served in inert","description":"Versions 1.1.1 and earlier of `inert` are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false.\n\nThe inert directory handler always allows files in hidden directories to be served, even when `showHidden` is false.\n\n\n## Recommendation\n\nUpdate to version \u003e= 1.1.1.","status":"published","published":"2020-08-31T22:47:41Z","modified":"2023-11-08T03:57:33.777084Z","cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:47.119724Z"}]}}