CVE-2019-5447

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jul 15, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-54488.1Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication datCVE-2019-54494.3A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidentialCVE-2019-54506.8Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in CVE-2019-54514.6Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing thCVE-2019-54522.4Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content CVE-2019-54536.1Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protectiCVE-2019-54549.8SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiringCVE-2019-54556.8Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process.CVE-2019-54568.1SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP CVE-2019-54575.4Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execuCVE-2019-54585.4Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execCVE-2019-54597.1An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.
CVE-2019-5447: Medium severity, CVSS 5.3 | Vulnix