Homepage

socket.io-file@1.0.12

File uploader module for Socket.io

  • latest version

    2.0.31

  • first published

    10 years ago

  • latest version published

    7 years ago

  • licenses detected

  • View socket.io-file package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the socket.io-file package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    File Type Restriction Bypass

    socket.io-file is a File uploader module for Socket.io

    Affected versions of this package are vulnerable to File Type Restriction Bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the name value to upload any file types.

    How to fix File Type Restriction Bypass?

    There is no fixed version for socket.io-file.

    *
    • H
    Directory Traversal

    socket.io-file is a File uploader module for Socket.io

    Affected versions of this package are vulnerable to Directory Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The socket.io-file::createFile message contains a name option that is passed directly to path.join(). It is possible to upload files to arbitrary folders on the server by sending relative paths on the name value, such as ../../test.js. The uploadDir and rename options can be used to define the file upload path.

    How to fix Directory Traversal?

    There is no fixed version for socket.io-file.

    *
    Go back to all versions of this package