CVE-2018-16202: Path Traversal in cordova-plugin-ionic-webview
Summary
CVE-2018-16202: Path Traversal in cordova-plugin-ionic-webview. Affects cordova-plugin-ionic-webview versions < 2.2.0. Fixed in 2.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The cordova-plugin-ionic-webview is an npm package that provides a WebView plugin for Cordova applications. It allows developers to embed web content within their mobile applications. The plugin launches a webserver on http://localhost:8080, enabling the app to access web content. However, versions prior to 2.2.0 suffer from a Path Traversal vulnerability. This vulnerability allows attackers to gain unauthorized access to local files on the operating system that should be inaccessible to third-party applications. By exploiting this vulnerability, an attacker can escape the iOS application sandbox and access sensitive files.
Vulnerability Detail
The Path Traversal vulnerability in cordova-plugin-ionic-webview arises from the package's failure to restrict access to the app itself. This allows an attacker to bypass the iOS application sandbox and access local files that should be protected. By sending specially crafted requests to the webserver launched by the package, an attacker can traverse directories and read or modify sensitive files on the operating system. The impact of this vulnerability can be severe, as it compromises the confidentiality and integrity of the affected application's data.
How To Fix
Latest published version: 5.0.1 as of 23 Oct 2026
npm install cordova-plugin-ionic-webview@5.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.0
This is the first release that contains the fix.
npm install cordova-plugin-ionic-webview@2.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 2.2.0 is not immediately feasible, developers can implement a workaround by manually restricting access to the webserver launched by cordova-plugin-ionic-webview. This can be achieved by modifying the server configuration to only allow requests from the app itself or from trusted sources. Here is an example of how to modify the server configuration in a Cordova project:
// Add the following code to the 'config.xml' file
<allow-navigation href="http://localhost:8080/*" />
Conclusion
The Path Traversal vulnerability in cordova-plugin-ionic-webview exposes the application to unauthorized access of local files. To mitigate this vulnerability, it is crucial to upgrade to version 2.2.0 or apply the provided workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cordova-plugin-ionic-webview →
FAQ
cordova-plugin-ionic-webview is an npm package that provides a WebView plugin for Cordova applications. It allows developers to embed web content within their mobile applications.
Path Traversal is a vulnerability that allows an attacker to access files and directories outside of the intended scope. In this case, the vulnerability in cordova-plugin-ionic-webview allows an attacker to access local files on the operating system that should be inaccessible to third-party applications.
The Path Traversal vulnerability in cordova-plugin-ionic-webview can lead to unauthorized access to sensitive files on the operating system. This can result in the exposure of confidential data, modification of critical files, and potential compromise of the affected application's integrity.
To fix this vulnerability, it is recommended to upgrade to version 2.2.0 of cordova-plugin-ionic-webview. This version includes the necessary security measures to prevent path traversal attacks. Developers should update their package dependencies to ensure they are using the patched version.
Yes, if upgrading to version 2.2.0 is not immediately feasible, developers can implement a workaround by manually restricting access to the webserver launched by cordova-plugin-ionic-webview. This can be achieved by modifying the server configuration to only allow requests from the app itself or from trusted sources.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
