p PatchFirst

CVE-2025-54387

CVE-2025-54387 · IPX is Vulnerable to Path Traversal via Prefix Matching Bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison. This is fixed in versions 1.3.2, 2.1.1 and 3.1.1.

CVSS 6.9 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ipx

    Versions
    • < 1.3.2: Affected
    • >= 2.0.0-0, < 2.1.1: Affected
    • >= 3.0.0, < 3.1.1: Affected

    No fix published

  • ipx npm

    Affected ranges
    • SEMVER: < 1.3.2

    Update to 1.3.2

  • ipx npm

    Affected ranges
    • SEMVER: ≥ 2.0.0-0, < 2.1.1

    Update to 2.1.1

  • ipx npm

    Affected ranges
    • SEMVER: ≥ 3.0.0, < 3.1.1

    Update to 3.1.1

Original sources

Check your server →