CVE-2017-16222

elding is a simple web server. elding is vulnerable to a directory traversal issue, allowing an attacker to access the filesystem by placing "../" in the url. The files accessible, however, are limited to files with a file extension. Sending a GET request to /../../../etc/passwd, for example, will return a 404 on etc/passwd/index.js.

• CWE-22
• CWE-22

• https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/eldingExploit, Third Party Advisory
• https://nodesecurity.io/advisories/415Third Party Advisory
• https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/eldingExploit, Third Party Advisory
• https://nodesecurity.io/advisories/415Third Party Advisory

Published

Jun 7, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16217fbr-client sends files through sockets via socket.io and web…
• CVE-2017-16218dgard8.lab6 is a static file server. dgard8.lab6 is vulnerab…
• CVE-2017-16219yttivy is a static file server. yttivy is vulnerable to a di…
• CVE-2017-1622IBM QRadar SIEM 7.2.8 and 7.3 does not validate, or incorrec…3.7
• CVE-2017-16220wind-mvc is an mvc framework. wind-mvc is vulnerable to a di…
• CVE-2017-16221yzt is a simple file server. yzt is vulnerable to a director…
• CVE-2017-16223nodeaaaaa is a static file server. nodeaaaaa is vulnerable t…
• CVE-2017-16224st is a module for serving static files. An attacker is able…
• CVE-2017-16225aegir is a module to help automate JavaScript project manage…
• CVE-2017-16226The static-eval module is intended to evaluate statically-an…
• CVE-2017-16227The aspath_put function in bgpd/bgp_aspath.c in Quagga befor…
• CVE-2017-16228Dulwich before 0.18.5, when an SSH subprocess is used, allow…