CVE-2020-7649: snyk-broker Path Traversal before v4.73.0
Summary
CVE-2020-7649: snyk-broker Path Traversal before v4.73.0. Affects snyk-broker versions < 4.73.0. Fixed in 4.73.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The snyk-broker package is an npm package that is part of the Snyk ecosystem. It is used for managing and securing dependencies in software projects. The package provides functionality for scanning and monitoring dependencies for vulnerabilities. However, prior to version 4.73.0, the snyk-broker package is vulnerable to a path traversal attack. This vulnerability allows users with access to Snyk's internal network to read arbitrary files by exploiting directory traversal techniques.
Vulnerability Detail
The vulnerability in the snyk-broker package allows an attacker to read arbitrary files on the server by manipulating file paths. By using directory traversal techniques, an attacker can bypass file access restrictions and access sensitive files that should not be accessible. This can lead to unauthorized disclosure of sensitive information, such as configuration files or credentials. The vulnerability has a CVSS score of 4.9, indicating a moderate severity level.
How To Fix
Latest published version: 5.24.6 as of 22 Oct 2026
npm install snyk-broker@5.24.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.73.0
This is the first release that contains the fix.
npm install snyk-broker@4.73.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the snyk-broker package as soon as possible.
Conclusion
The snyk-broker package before version 4.73.0 is vulnerable to a path traversal attack, allowing unauthorized file reads. To mitigate this vulnerability, it is recommended to upgrade to version 4.73.0 or later of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for snyk-broker →
FAQ
This vulnerability allows an attacker to read arbitrary files on the server, potentially leading to unauthorized disclosure of sensitive information.
Users of the snyk-broker package before version 4.73.0 are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of writing.
Yes, the vulnerability has been fixed in version 4.73.0 of the snyk-broker package.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the Vulert Playground will analyze it for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for snyk-broker.
