CVE-2025-59342

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59342
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-59342.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-59342
Aliases
Downstream
openSUSE (2)
SUSE (1)
Related
openSUSE (2)
SUSE (1)
Published
2025-09-17T17:59:34Z
Modified
2026-10-16T02:57:21Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header
Details

esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Version 136.1 contains a patch.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-24"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59342.json"
}
References

Affected packages

Git / github.com/esm-dev/esm.sh

Affected ranges

Type
GIT
Repo
https://github.com/esm-dev/esm.sh
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
833a29f42aeb0acbd7089a71be11dd0a292d3151
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "136"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "833a29f42aeb0acbd7089a71be11dd0a292d3151"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
v100
v101
v102
v103
v104
v105
v106
v107
v108
v109
v110
v111
v112
v113
v114
v115
v116
v117
v119
v120
v121
v122
v123
v124
v125
v126
v127
v128
v129
v130
v131
v132
v133
v134
v135
v135_1
v136
v34
v35
v37
v38
v39
v40
v41
v43
v44
v45
v46
v47
v49
v50
v51
v52
v53
v55
v56
v57
v59
v60
v61
v62
v63
v64
v65
v66
v67
v68
v69
v70
v71
v72
v73
v74
v75
v76
v77
v78
v79
v80
v81
v82
v83
v84
v85
v86
v87
v88
v89
v90
v91
v92
v93
v94
v95
v96
v97
v98
v99

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-59342.json"