CVE-2021-25864

Name of the Vulnerable Software and Affected Versions node-red-contrib-huemagic version 3.0.0

Description The issue allows for Directory Traversal, enabling access to arbitrary files. This is achieved through the res.sendFile API in the file hue-magic.js, using the hue/assets/..%2F path.

Recommendations For node-red-contrib-huemagic version 3.0.0, consider disabling the res.sendFile API in the hue-magic.js file until a patch is available. Restrict access to the hue-magic.js file to minimize the risk of exploitation. Avoid using the hue/assets/..%2F path in the affected API endpoint until the issue is resolved.