CVE-2017-16029: Directory Traversal in hostr
Summary
CVE-2017-16029: Directory Traversal in hostr. Affects hostr versions < 2.3.6. Fixed in 2.3.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hostr is an npm package that provides hosting for static websites. It allows users to easily deploy their websites and share them with others. However, versions of Hostr prior to 2.3.6 are vulnerable to directory traversal attacks. This means that an attacker can manipulate the URL path in a GET request to access files outside of the current directory. This can lead to unauthorized access to sensitive information and potential data breaches.
Vulnerability Detail
The vulnerability in Hostr arises from insufficient input validation in the URL path for GET requests. By including ../ in the path, an attacker can traverse directories and access files outside of the intended scope. This can be exploited to read sensitive files, such as configuration files or user data, that should not be accessible to the public. The impact of this vulnerability depends on the specific files that can be accessed and the sensitivity of the information contained within them.
How To Fix
Latest published version: 4.0.3 as of 23 Oct 2026
npm install hostr@4.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.6
This is the first release that contains the fix.
npm install hostr@2.3.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The directory traversal vulnerability in Hostr can allow attackers to access sensitive files outside of the intended scope. To mitigate this risk, it is crucial to upgrade to version 2.3.6 or later of Hostr. This will ensure that proper input validation is in place to prevent directory traversal attacks. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hostr →
FAQ
Directory traversal is a technique used by attackers to access files and directories that are located outside of the intended scope. It involves manipulating file paths to navigate to parent directories or other parts of the file system.
With directory traversal, an attacker can potentially access sensitive files that should not be publicly accessible. This can include configuration files, user data, or other confidential information. The impact of the attack depends on the specific files that can be accessed and the sensitivity of the information within them.
You can use the Vulert Playground at Vulert Scanner to check if your version of Hostr is affected by this vulnerability. Simply enter the package name and version, and the playground will provide information on any known vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Hostr to ensure the security of your application.
There are no known public exploits specifically targeting this vulnerability in Hostr. However, it is important to address the vulnerability promptly to prevent potential attacks.
