Path Traversal Vulnerability in m-server

m-server Updated 02 Oct 2025

Summary

11/06/2019

Disclosed on

MODERATE

Severity

Yes i

Fix available

Moderate

Severity

Not published

CVSS Score

GHSA-vc6r-4x6g-mmqc: Path Traversal in m-server. Affects m-server versions < 1.4.2. Fixed in 1.4.2. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

m-server is an npm package that provides server functionality for web applications. It allows developers to create and manage servers for their applications. However, versions of m-server before 1.4.2 are vulnerable to a path traversal vulnerability. This vulnerability allows a remote attacker to access and display the content of arbitrary files on the server.

Vulnerability Detail

The path traversal vulnerability in m-server arises from improper input validation. By manipulating the file path parameter in certain requests, an attacker can navigate outside of the intended directory and access sensitive files on the server. This can lead to unauthorized disclosure of sensitive information and potential compromise of the server.

How To Fix

Latest published version: 1.4.2 as of 22 Oct 2026

npm install m-server@1.4.2

The newest release already contains this fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Conclusion

The path traversal vulnerability in m-server can be mitigated by updating to version 1.4.2 or later. It is crucial to promptly apply the update to protect the server from potential attacks. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for m-server →

FAQ

What is m-server?

m-server is an npm package that provides server functionality for web applications. It allows developers to create and manage servers for their applications.

What is a path traversal vulnerability?

A path traversal vulnerability occurs when an attacker is able to navigate outside of the intended directory structure and access files that should be restricted. In the case of m-server, this vulnerability allows an attacker to view the content of arbitrary files on the server.

What are the potential consequences of this vulnerability?

The path traversal vulnerability in m-server can lead to unauthorized disclosure of sensitive information. An attacker could access and view files containing sensitive data, such as configuration files or user credentials. This could result in further compromise of the server or unauthorized access to sensitive systems.

How can I protect my server from this vulnerability?

To protect your server from this vulnerability, it is important to update m-server to version 1.4.2 or later. This version includes a fix for the path traversal issue. Additionally, it is recommended to follow secure coding practices and implement proper input validation to prevent similar vulnerabilities in the future.