CVE-2025-54387: IPX Path Traversal Vulnerability via Prefix Matching Bypass
Summary
CVE-2025-54387: IPX Allows Path Traversal via Prefix Matching Bypass. Affects ipx across 3 version ranges.
< 1.3.2
>= 2.0.0-0, < 2.1.1
>= 3.0.0, < 3.1.1
Fixed in 1.3.2, 2.1.1 or 3.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
IPX is a popular npm package used for image processing, enabling developers to serve images efficiently. It allows for dynamic image transformations and optimizations. However, a vulnerability has been identified that permits unauthorized access to files outside the designated directory due to improper path validation.
Vulnerability Detail
The vulnerability arises from the method used to verify whether a requested path is within the allowed directories. Specifically, if the allowed directories do not end with a path separator, the prefix matching check can be bypassed. This flaw allows attackers to access files outside the intended directory, leading to potential data exposure. The issue is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.21.3.2npm install ipx@1.3.2 -
>= 2.0.0-0, < 2.1.12.1.1npm install ipx@2.1.1 -
>= 3.0.0, < 3.1.13.1.1npm install ipx@3.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the directory specified in the IPX configuration ends with a path separator. Modify the directory setting in your code as follows:
const ipx = createIPX({
storage: ipxFSStorage({ dir: './public/' }),
});
Conclusion
The IPX package has a significant vulnerability that allows path traversal due to improper path validation. It is crucial to update to the latest patched versions to protect your application from potential exploitation. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for ipx →
FAQ
The vulnerability allows for path traversal, enabling unauthorized access to files outside the intended directory.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to sensitive files, potentially exposing user data or application secrets.
Yes, patches are available for various versions of the IPX package. Ensure you update to the specified patched versions.
Implement the suggested workaround by ensuring the directory path ends with a separator to mitigate the risk until you can update.
