CVE-2022-21192

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join().

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	serve-lite	< *

References

https://gist.github.com/lirantal/9ccdfda0edcb95e36d07a04b0b6c2db0Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SERVELITE-3149916Exploit, Third Party Advisory
https://gist.github.com/lirantal/9ccdfda0edcb95e36d07a04b0b6c2db0Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SERVELITE-3149916Exploit, Third Party Advisory

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-211937.5Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an arbitrary file on the CVE-2022-211949.8The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUM CVE-2022-211957.5All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash.CVE-2022-211969.8MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5 CVE-2022-211977.5Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of CVE-2022-211986.4Time-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable CVE-2022-211995.9An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man CVE-2022-21209.8OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write CVE-2022-212018.8A stack-based buffer overflow vulnerability exists in the confers ucloud_add_node_new functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_CVE-2022-212025.5The affected product is vulnerable to an out-of-bounds read, which may result in disclosure of sensitive information.CVE-2022-212037.8Improper permissions in the SafeNet Sentinel driver for Intel(R) Quartus(R) Prime Standard Edition before version 21.1 may allow an authenti CVE-2022-212047.8Improper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable esc