oak's path traversal allows transfer of hidden files within the served root directory
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
`oak` is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default `oak` does not allow transferring of hidden files with `Context.send` API. However, prior to version 17.1.3, this can be bypassed by encoding `/` as its URL encoded form `%2F`. For an attacker this has potential to read sensitive user data or to gain access to server secrets. Version 17.1.3 fixes the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| oakserver | oak | before 17.1.3 | 17.1.3 | Patch available | CNA |
| — | @oakserver/oak (npm) | up to 14.1.0 | — | No fix listed | GHSA-qm92-93fv-vh7m |
- oak Vendoroakserver Affected before 17.1.3 Fixed in 17.1.3 Patch available CNA
- @oakserver/oak (npm) Vendor— Affected up to 14.1.0 Fixed in — No fix listed GHSA-qm92-93fv-vh7m
Remediation
- Fix · CNA oak (oakserver) Fixed in 17.1.3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-49770
- 2026-10-03 Alias added: GHSA-qm92-93fv-vh7m
References
Other 5
- https://github.com/oakserver/oak/security/advisories/GHSA-qm92-93fv-vh7m
- https://github.com/oakserver/oak/commit/4b2f27efd5cba5a45b2c3982e610da3af0869209
- https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L117-L125
- https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L182C10-L182C25
- https://github.com/oakserver/oak
More oakserver vulnerabilities
- TI-2025-34835 oak: ReDoS in x-forwarded-proto and x-forwarded-for headers CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-49770 · CVE Program
- CVE-2024-49770 · NVD
- FIRST EPSS
- GHSA-qm92-93fv-vh7m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences