CVE-2023-46493

Name of the Vulnerable Software and Affected Versions EverShop NPM versions prior to 1.0.0-rc.8

Description The issue allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync function in fileBrowser/browser.js. This enables the attacker to potentially access unauthorized files and data.

Recommendations For versions prior to 1.0.0-rc.8, update to version 1.0.0-rc.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the readDirSync function in fileBrowser/browser.js to minimize the risk of exploitation.