Boriboy Abdurahmonov

**Name of the Vulnerable Software and Affected Versions** cube-root/directory-serve versions prior to 1.3.8 **Description** A path traversal issue exists where an unauthenticated remote attacker can delete arbitrary files outside the intended served directory. This occurs when the application is executed with the `--delete` option. The `lib/middleware/file-remove.js` middleware fails to sanitize the `file` parameter in the request query before using it to construct file system paths, allowing the use of `../` sequences to traverse directories. **Recommendations** Update cube-root/directory-serve to version 1.3.8 or later. As a temporary mitigation, avoid running the application with the `--delete` option.

**Name of the Vulnerable Software and Affected Versions** cube-root/directory-serve versions prior to 1.3.8 **Description** A stored cross-site scripting (XSS) issue exists where an attacker can inject arbitrary JavaScript into the web interface. This occurs when a file is uploaded with a crafted filename containing HTML attribute-breaking characters. The `lib/helper/html.js` file fails to sanitize filenames before embedding them in HTML templates at line 28, which allows the script to execute in the browsers of other users viewing the file listing. **Recommendations** Update cube-root/directory-serve to version 1.3.8 or later.

**Name of the Vulnerable Software and Affected Versions** mustafaakin/cast-localvideo (affected versions not specified) **Description** A path traversal issue allows an unauthenticated remote attacker to read arbitrary files from the server. The `app.js` handler passes the user-supplied `req.body.dir` parameter directly to the `res.sendFile()` function without proper sanitization. This allows the use of absolute paths or `../` sequences to access sensitive system files. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `req.body.dir` parameter in the affected handler until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** o1lab/xmysql (affected versions not specified) **Description** An unauthenticated remote attacker can read and download arbitrary files from the server. The issue occurs in the `lib/xapi.js` file where the `req.query.name` parameter is used in `path.join(cwd, name)` without proper sanitization before being passed to the `res.download()` function. This allows directory traversal using `../` sequences to access sensitive system files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 4xmen/pm2panel (affected versions not specified) **Description** An OS command injection flaw allows an authenticated remote attacker to execute arbitrary system commands on the host. The issue occurs in the pm2panel.js handler where the `id` parameter from the `req.query` object is passed directly to the `exec()` function without proper input validation or shell escaping. This allows an attacker to use shell metacharacters, such as semicolons, to chain and execute unauthorized commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.