Read the docs
TI-2020-06169 Aliases CVE-2020-7648GHSA-9xv2-548x-5h79

Path traversal in snyk-broker

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`

Why it matters now

EPSS 0.0113 66th percentileScored 2026-11-07
Fix Fixed snyk-broker: 4.72.2snyk-broker (npm): 4.72.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—snyk-brokerbefore 4.72.24.72.2Patch availableCNA
—snyk-broker (npm)before 4.72.24.72.2Patch availableGHSA-9xv2-548x-5h79
  • snyk-broker Vendor— Affected before 4.72.2 Fixed in 4.72.2 Patch available CNA
  • snyk-broker (npm) Vendor— Affected before 4.72.2 Fixed in 4.72.2 Patch available GHSA-9xv2-548x-5h79

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:synk:broker:*:*:*:*:*:*:*:*before 4.72.2VulnerableSynk
  • cpe:2.3:a:synk:broker:*:*:*:*:*:*:*:* Versions before 4.72.2 Vulnerable ·Synk

Remediation

  • Fix · CNA snyk-broker Fixed in 4.72.2
  • Fix · GHSA-9xv2-548x-5h79 snyk-broker (npm) Fixed in 4.72.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7648
  2. 2026-10-03 Alias added: GHSA-9xv2-548x-5h79

References

Advisory 1

  • TI-2020-06175 Sensitive information in log files in snyk-broker CVSS 3.1HIGH 7.5
  • TI-2020-06173 Path traversal in snyk-broker CVSS 3.1MEDIUM 6.5
  • TI-2020-06174 Link following in snyk-broker CVSS 3.1MEDIUM 6.5
  • TI-2020-06171 Path traversal in snyk-broker CVSS 3.1MEDIUM 6.5
  • TI-2020-06172 Path traversal in snyk-broker CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences