Coursevault Preview
Approved changes feed: RSS · Atom
cpe:2.3:a:moritzmyrz:coursevault-preview:*:*:*:*:*:node.js:*:*part: a version: * update: *
| Vendor | Moritzmyrz (6abf7a17-ad87-5f76-8caa-1c0e094dfe7c) |
|---|---|
| Product | Coursevault Preview (88638553-27ea-591b-a80d-a2e3dbb7ffc6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/moritzmyrz/coursevault-preview |
purl2cpe | 2026-06-01 10:18:04.032190 |
pkg:npm/coursevault-preview |
purl2cpe | 2026-07-28 16:41:16.971885 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-35613 |
vulnerable | 2026-06-08 07:59:14.187647 |
Path traversal in coursevault-preview due to improper base-directory boundary validation
MEDIUM (5.1)
coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument to affected CoursevaultPreview methods may be able to read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix. This vulnerability is fixed in 0.1.1.
Published: 2026-04-07T16:39:44.237Z
Updated: 2026-04-09T16:18:16.501Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.