7.5
CVE-2025-27210
- EPSS 1.91%
- Published 18.07.2025 22:54:27
- Last modified 22.07.2025 13:06:07
- Source support@hackerone.com
- Teams watchlist Login
- Open Login
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Vendornodejs
≫
Product
node
Default Statusunaffected
Version <
20.19.4
Version
20.0.0
Status
affected
Version <
22.17.1
Version
22.0.0
Status
affected
Version <
24.4.1
Version
24.0.0
Status
affected
Vendornodejs
≫
Product
nodejs
Default Statusunaffected
Version <
4.*
Version
4.0
Status
affected
Version <
5.*
Version
5.0
Status
affected
Version <
6.*
Version
6.0
Status
affected
Version <
7.*
Version
7.0
Status
affected
Version <
8.*
Version
8.0
Status
affected
Version <
9.*
Version
9.0
Status
affected
Version <
10.*
Version
10.0
Status
affected
Version <
11.*
Version
11.0
Status
affected
Version <
12.*
Version
12.0
Status
affected
Version <
13.*
Version
13.0
Status
affected
Version <
14.*
Version
14.0
Status
affected
Version <
15.*
Version
15.0
Status
affected
Version <
16.*
Version
16.0
Status
affected
Version <
17.*
Version
17.0
Status
affected
Version <
18.*
Version
18.0
Status
affected
Version <
19.*
Version
19.0
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.91% | 0.826 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| support@hackerone.com | 7.5 | 3.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.