CVE-2018-3732: Path Traversal in resolve-path
Summary
CVE-2018-3732: Path Traversal in resolve-path. Affects resolve-path versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The resolve-path package is an npm package used for resolving file paths. It is commonly used in Node.js applications to handle file operations. The package allows users to resolve relative paths to absolute paths. However, versions of resolve-path before 1.4.0 are vulnerable to a path traversal vulnerability. This vulnerability affects Windows-based paths and occurs due to a lack of file path sanitization.
Vulnerability Detail
The path traversal vulnerability in resolve-path allows an attacker to access files outside of the intended directory. By manipulating the input to the package, an attacker can traverse the file system and potentially access sensitive files or execute arbitrary code. This vulnerability has a high severity rating (CVSS score of 7.5) and can lead to unauthorized access or data leakage.
How To Fix
Latest published version: 1.4.0 as of 23 Oct 2026
npm install resolve-path@1.4.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The resolve-path package before version 1.4.0 is vulnerable to a path traversal issue, which can allow unauthorized access to files outside of the intended directory. To mitigate this vulnerability, it is crucial to update to version 1.4.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for resolve-path →
FAQ
This vulnerability allows an attacker to access files outside of the intended directory, potentially leading to unauthorized access or data leakage.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the tool will analyze it for vulnerabilities.
No, only versions before 1.4.0 are vulnerable to this path traversal issue. It is recommended to update to the latest version to mitigate the vulnerability.
No, the recommended solution is to update to version 1.4.0 or later of the resolve-path package.
There are no known public exploits for this vulnerability at the moment. However, it is still important to update to the latest version to prevent any potential attacks.
