CVE-2022-25937: Path Traversal Vulnerability in glance
Summary
CVE-2022-25937: Path traversal vulnerability in glance. Affects glance versions < 3.0.9. Fixed in 3.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Glance is an npm package used for image recognition and processing. It provides functionalities for reading and manipulating images. However, versions of the package glance before 3.0.9 are vulnerable to a Directory Traversal vulnerability. This vulnerability allows users to read files outside the public root directory. It is important to note that this vulnerability is related to, but distinct from, the vulnerability reported in CVE-2018-3715.
Vulnerability Detail
The Directory Traversal vulnerability in glance allows attackers to access files outside the intended directory structure. By manipulating file paths, an attacker can bypass access restrictions and read sensitive files on the system. This can lead to unauthorized disclosure of sensitive information and potential further exploitation of the system. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 3.0.9 as of 23 Oct 2026
npm install glance@3.0.9The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the glance package to mitigate the risk.
Conclusion
The Directory Traversal vulnerability in the glance package allows attackers to read sensitive files outside the intended directory structure. To mitigate the risk, it is crucial to update to version 3.0.9 or later of the glance package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for glance →
FAQ
The vulnerability allows attackers to read sensitive files outside the intended directory structure, potentially leading to unauthorized disclosure of sensitive information.
No, there is no known workaround. It is necessary to update to the fixed version of the glance package.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
No, only versions before 3.0.9 are vulnerable to this specific Directory Traversal vulnerability.
Yes, this vulnerability is related to, but distinct from, the vulnerability reported in CVE-2018-3715.
Related vulnerabilities
Recent vulnerabilities recorded for glance.
