CVE-2025-67487

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-67487
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-67487.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-67487
Aliases
Published
2025-12-09T03:35:58.257Z
Modified
2025-12-13T12:51:22.574145Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Static Web Server is vulnerable to symbolic link Path Traversal
Details

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Versions 2.40.0 and below contain symbolic links (symlinks) which can be used to access files or directories outside the intended web root folder. SWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. This issue is fixed in version 2.40.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67487.json",
    "cwe_ids": [
        "CWE-61"
    ]
}
References

Affected packages

Git / github.com/static-web-server/static-web-server

Affected ranges

Type
GIT
Repo
https://github.com/static-web-server/static-web-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8a930ca88e415ff6e091d208839be940577c55ce

Affected versions

1.*

1.0.0-beta.2
1.0.0-beta.3
1.0.0-beta.4

v1.*

v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v1.9.1
v1.9.2

v2.*

v2.0.0
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-beta.3
v2.0.0-beta.4
v2.0.0-beta.5
v2.0.0-beta.6
v2.0.0-beta.7
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.13.1
v2.14.0
v2.14.1
v2.14.2
v2.15.0
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.2.0
v2.20.0
v2.20.1
v2.20.2
v2.21.0
v2.21.1
v2.22.0
v2.22.1
v2.23.0
v2.24.0
v2.24.1
v2.24.2
v2.25.0
v2.26.0
v2.27.0
v2.28.0
v2.3.0
v2.30.0
v2.31.0
v2.31.1
v2.32.0
v2.32.1
v2.32.2
v2.33.0
v2.33.1
v2.34.0
v2.35.0
v2.36.0
v2.36.1
v2.37.0
v2.38.0
v2.38.1
v2.39.0
v2.4.0
v2.40.0
v2.5.0
v2.6.0
v2.6.0-beta.1
v2.6.0-beta.2
v2.7.0
v2.7.1
v2.8.0
v2.9.0