CVE-2018-3731: Path Traversal in public
Summary
CVE-2018-3731: Path Traversal in public. Affects public versions < 0.1.3. Fixed in 0.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'public' package is an npm package that provides functionality for handling file paths. It is used by various applications to manage file operations. However, versions of 'public' before 0.1.3 are vulnerable to a path traversal attack. This vulnerability arises due to the lack of file path sanitization, allowing a malicious user to read any file accessible to the parent process on the server.
Vulnerability Detail
The path traversal vulnerability in 'public' allows an attacker to bypass file access restrictions and read sensitive files on the server. By manipulating file paths, an attacker can traverse directories and access files outside the intended scope. This can lead to unauthorized disclosure of sensitive information or the execution of arbitrary code.
How To Fix
Latest published version: 0.1.5 as of 22 Oct 2026
npm install public@0.1.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.3
This is the first release that contains the fix.
npm install public@0.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating to the latest version of the 'public' package is the recommended solution.
Conclusion
The 'public' package versions prior to 0.1.3 are vulnerable to a path traversal attack, allowing unauthorized access to sensitive files on the server. To mitigate this risk, it is recommended to update to version 0.1.3 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for public →
FAQ
This vulnerability allows an attacker to read sensitive files on the server, potentially leading to unauthorized disclosure of information or the execution of arbitrary code.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes the package-lock.json file to identify vulnerable dependencies.
While there are no known public exploits for this specific vulnerability, it is important to update to the latest version of the 'public' package to prevent any potential attacks.
The recommended approach is to update to the latest version of the 'public' package. However, if updating is not feasible, you can consider implementing additional security measures such as access controls and input validation to mitigate the risk.
There is no evidence of active exploitation of this vulnerability at the moment. However, it is crucial to update to the latest version of the 'public' package to ensure the security of your application.
Related vulnerabilities
Recent vulnerabilities recorded for public.
