Path Traversal Vulnerability in servey
Summary
GHSA-rv49-54qp-fw42: Path Traversal in servey. Affects servey versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Servey is an npm package used for conducting surveys. It allows users to create and manage surveys, collect responses, and analyze the data. The package is vulnerable to a Path Traversal attack, which allows attackers to access server files by exploiting insufficient input sanitization.
Vulnerability Detail
The vulnerability in servey arises from a lack of proper input sanitization. Attackers can exploit this by using relative paths to access sensitive server files. This can lead to unauthorized access, disclosure of sensitive information, and potential compromise of the server.
How To Fix
Latest published version: 5.2.6 as of 23 Oct 2026
npm install servey@5.2.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.0
This is the first release that contains the fix.
npm install servey@3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Path Traversal vulnerability in servey can be fixed by upgrading to the latest version. It is important to promptly update the package to ensure the security of the server and prevent unauthorized access to sensitive files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for servey →
FAQ
Servey is an npm package used for creating and managing surveys.
A Path Traversal attack is a type of security vulnerability where an attacker can access files or directories outside of the intended scope.
This vulnerability can lead to unauthorized access to sensitive server files, disclosure of confidential information, and potential compromise of the server.
To fix this vulnerability, you should upgrade to the latest version of servey (version 3.1.0 or above).
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for servey.
