Description

A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one directory above the intended output path. This could lead to information disclosure if the middleware is configured to use the physical filesystem.

Mitigation

Aliases