CVE-2017-16038: Directory Traversal in f2e-server
Summary
CVE-2017-16038: Directory Traversal in f2e-server. Affects f2e-server versions < 1.12.12. Fixed in 1.12.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
f2e-server is an npm package that provides a server for front-end development. It allows developers to build and test their web applications locally. The package is widely used in the JavaScript ecosystem. However, versions of f2e-server up to 1.12.11 are vulnerable to a directory traversal attack.
Vulnerability Detail
The vulnerability in f2e-server arises from its resolution of relative file paths, which can be exploited by an attacker to access files outside of the intended directory root. By crafting a malicious request, an attacker can traverse directories and potentially gain access to sensitive files on the vulnerable system. For example, an attacker could send a GET request with a crafted path to access the '/etc/passwd' file. This vulnerability poses a significant risk as it may lead to the disclosure of private files and sensitive information.
How To Fix
Latest published version: 2.20.13 as of 22 Oct 2026
npm install f2e-server@2.20.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.12
This is the first release that contains the fix.
npm install f2e-server@1.12.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The directory traversal vulnerability in f2e-server can be exploited by an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information. It is crucial to update to version 1.12.12 or later to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for f2e-server →
FAQ
The vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information.
You can check the version of f2e-server in your project's package-lock.json file. If the version is 1.12.11 or below, your installation is vulnerable.
There are no known public exploits for this vulnerability at the moment. However, it is crucial to update to the patched version to mitigate the risk.
No, the recommended solution is to update f2e-server to version 1.12.12 or later.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-g7j3-p357-cw8p/GHSA-g7j3-p357-cw8p.json
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
