What’s Vulnerable › Vulnerabilities

CVE-2020-15779

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-07-15 · updated 2026-06-17
• Weakness: CWE-22

Description

A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path.

Affected products

• Socket.Io-File Project Socket.Io-File: through 2.0.31

References

• https://github.com/advisories/GHSA-9h4g-27m8-qjrg
• https://github.com/rico345100/socket.io-file
• https://www.npmjs.com/advisories/1519
• https://www.npmjs.com/package/socket.io-file
• https://github.com/advisories/GHSA-9h4g-27m8-qjrg
• https://github.com/rico345100/socket.io-file
• https://www.npmjs.com/advisories/1519
• https://www.npmjs.com/package/socket.io-file

Get alerted when CVE-2020-15779 or the next vulnerability affects your stack