7.5
CVE-2025-27210
- EPSS 7.73%
- Veröffentlicht 18.07.2025 22:54:27
- Zuletzt bearbeitet 15.04.2026 00:35:42
- Quelle support@hackerone.com
- CVE-Watchlists
- Unerledigt
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellernodejs
≫
Produkt
node
Default Statusunaffected
Version
20.0.0
Version <
20.19.4
Status
affected
Version
22.0.0
Version <
22.17.1
Status
affected
Version
24.0.0
Version <
24.4.1
Status
affected
Herstellernodejs
≫
Produkt
nodejs
Default Statusunaffected
Version
4.0
Version <
4.*
Status
affected
Version
5.0
Version <
5.*
Status
affected
Version
6.0
Version <
6.*
Status
affected
Version
7.0
Version <
7.*
Status
affected
Version
8.0
Version <
8.*
Status
affected
Version
9.0
Version <
9.*
Status
affected
Version
10.0
Version <
10.*
Status
affected
Version
11.0
Version <
11.*
Status
affected
Version
12.0
Version <
12.*
Status
affected
Version
13.0
Version <
13.*
Status
affected
Version
14.0
Version <
14.*
Status
affected
Version
15.0
Version <
15.*
Status
affected
Version
16.0
Version <
16.*
Status
affected
Version
17.0
Version <
17.*
Status
affected
Version
18.0
Version <
18.*
Status
affected
Version
19.0
Version <
19.*
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 7.73% | 0.92 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| support@hackerone.com | 7.5 | 3.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.