socket.io-file

socket.io-file

Releases30

Frequency1 month 3 days

Last Release over 7 years ago

File uploader module for Socket.io

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2020-24807 ↗	Oct 6, 2020Tuesday, 6 October 2020, 18:15	7.8 HIGH	6.8 MEDIUM
The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2020-15779 ↗	Jul 15, 2020Wednesday, 15 July 2020, 21:15	7.5 HIGH	5 MEDIUM
A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path.