{"id":"CVE-2016-10528","aliases":["EUVD-2019-0363","GHSA-xg5r-8j97-2wrj"],"status":"published","title":"Directory Traversal in restafary","description":"restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified.","severity":{"version":"3.0","score":4.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0118,"percentile":0.67893,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2018-05-31T20:00:00Z","modified":"2026-10-24T10:30:49Z","fixes":[{"ecosystem":"npm","package":"restafary","fixed_in":["1.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"restafary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}]},{"source":"osv","ecosystem":"npm","package":"restafary","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}]}],"products":[{"vendor":"hackerone","product":"restafary node module"},{"vendor":"restafary_project","product":"restafary"}],"references":[{"url":"https://nodesecurity.io/advisories/89","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10528","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xg5r-8j97-2wrj","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/89","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-10528","description":"restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified.","status":"published","published":"2018-05-31T20:00:00Z","modified":"2024-09-17T01:30:39.884Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2019-0363","description":"restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified.","status":"published","published":"2018-05-31T20:00:00Z","modified":"2024-09-17T01:30:39Z","updated_at":"2026-11-03T00:28:49.329777Z"}],"ghsa":[{"id":"GHSA-xg5r-8j97-2wrj","title":"Directory Traversal in restafary","description":"Affected versions of `restafary` are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.\n\n\nProof of Concept\n\n```\ncurl -i -s -k  -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'\n```\n\n\n## Recommendation\n\nUpdate to version 1.6.1 or later.","status":"published","published":"2019-02-18T23:39:22Z","modified":"2023-01-09T05:03:39Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:05.705235Z"}],"nvd":[{"id":"CVE-2016-10528","description":"restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified.","status":"published","published":"2018-05-31T20:29:00.893Z","modified":"2026-06-17T00:39:52.947Z","cvss":[{"version":"3.0","score":4.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:39.176887Z"}],"osv":[{"id":"CVE-2016-10528","description":"restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified.","status":"published","published":"2018-05-31T20:29:00.893Z","modified":"2026-10-24T10:30:49.98291981Z","cvss":[{"version":"3.0","score":4.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"GHSA-xg5r-8j97-2wrj","title":"Directory Traversal in restafary","description":"Affected versions of `restafary` are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.\n\n\nProof of Concept\n\n```\ncurl -i -s -k  -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'\n```\n\n\n## Recommendation\n\nUpdate to version 1.6.1 or later.","status":"published","published":"2019-02-18T23:39:22Z","modified":"2023-11-08T03:58:10.722738Z","cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}