What is GHSA-vcxh-qvgr-9fw9?

GHSA-vcxh-qvgr-9fw9 is a security advisory published by GitHub Security Advisories with High severity. m.static Directory Traversal vulnerability

Which CVE IDs does GHSA-vcxh-qvgr-9fw9 cover?

GHSA-vcxh-qvgr-9fw9 covers the following CVE IDs: CVE-2023-26126. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vcxh-qvgr-9fw9?

GHSA-vcxh-qvgr-9fw9 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-vcxh-qvgr-9fw9?

GHSA-vcxh-qvgr-9fw9 affects 1 product, including: npm/m.static:\u003c= 2.2.0.

GHSA-vcxh-qvgr-9fw9HighCVSS 7.5

m.static Directory Traversal vulnerability

Vendor

GitHub Security Advisories

Published

May 10, 2023

Last Modified

September 26, 2025

🔗 CVE IDs covered (1)

CVE-2023-26126 →

📋 Description

All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile function.

🎯 Affected products1

npm/m.static:<= 2.2.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-26126
https://gist.github.com/lirantal/dcb32c11ce87f5aafd2282b90b4dc998
https://security.snyk.io/vuln/SNYK-JS-MSTATIC-3244915
https://github.com/ivoputzer/m.static/blob/master/index.js#L19
https://github.com/advisories/GHSA-vcxh-qvgr-9fw9