npm http-file-server vulnerabilities

Latest npm http-file-server CVEs

Newest publication first

1. CVE-2019-5458 Cross-Site Scripting in http-file-server

   Published 2019-07-30

   Medium·CVSS 5.4 EPSS 0.71%

   Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.

2. CVE-2019-5447 Path Traversal in http-file-server

   Published 2019-07-15

   Medium·CVSS 5.3 EPSS 1.5%

   A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.