CVE-2024-43035
CVE-2024-43035
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.
CVSS 5.8 · Medium · EPSS 2.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
fonoster
- Versions
- ≥ 0.5.5, < 0.6.1: Affected (semver)
Update to 0.6.1
@fonoster/voice npm
- Affected ranges
- SEMVER: ≥ 0.5.5, < 0.6.1
Update to 0.6.1