CyberRota Analysis
AI-GeneratedA critical path traversal vulnerability exists in the cube-root/directory-serve application, allowing unauthenticated remote attackers to delete arbitrary files outside the intended directory when the application is executed with the --delete option. The flaw arises from inadequate sanitization of the req.query.file parameter, which permits attackers to manipulate file system paths using directory traversal sequences. Organizations utilizing this application should prioritize immediate remediation to prevent potential data loss and system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.