CVE-2017-16038

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. This is compounded by `f2e-server` requiring elevated privileges to run.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
HackerOne	f2e-server node module	<= 1.12.11

References

https://github.com/shy2850/node-server/issues/10Exploit, Issue Tracking, Third Party Advisory
https://github.com/shy2850/node-server/pull/12/filesPatch
https://nodesecurity.io/advisories/346Third Party Advisory
https://github.com/shy2850/node-server/issues/10Exploit, Issue Tracking, Third Party Advisory
https://github.com/shy2850/node-server/pull/12/filesPatch
https://nodesecurity.io/advisories/346Third Party Advisory

Timeline

Published: Jun 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-160397.5`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by pl CVE-2017-16045.4IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in CVE-2017-160408.1gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM atta CVE-2017-160415.9ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.CVE-2017-160429.8Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing fo CVE-2017-160436.1Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will r CVE-2017-160447.5`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160457.5`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160467.5`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160477.5mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160487.5`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160497.5`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.