--- title: "CVE-2023-46497" date: "2023-09-25T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cve-2023-46497/" --- # CVE-2023-46497 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Sep 26, 2023 CVE-2023-46497 **Published:** Sep 25, 2023 4.1 Medium Severity arbitrary deletion file js npm path relative traversal MT Mário Teixeira Reported by Checkmarx Zero Details Overview ## Summary NPM’s package `@evershop/evershop` prior to 1.0.0-rc.8 is missing input validation in the function ‘mkdirSync’ in ‘createFolder.js’, leading to a Relative Path Traversal vulnerability that enables arbitrary folder creation. From the feature for adding an image to a Product’s “Description” field, attackers can create a new folder in unintended locations by navigating backward with “../”, potentially affecting system processes. ## Product This vulnerability affects NPM’s package `@evershop/evershop` in versions prior to 1.0.0-rc.8. ## Impact Although an attacker would be limited in the impact, this could be abused to bring some nefarious consequences. For instance, an attacker could create specific folders with common names in various locations on the filesystem that could eventually interfere with the regular functioning of some processes, even causing some to malfunction and break. ## Steps to reproduce 1. Install the `@evershop/evershop` package dependency for any version prior to 1.0.0-rc.8 2. Run the EverShop Web Application on localhost 3. Navigate to `admin/products/new` 4. In the Product’s “Description” field type `../../../hacked` (use “../” as many times as needed to navigate backwards towards the desired folder) 5. Navigate to the chosen folder and list all the files and folders ### Expected result: New folder can be created in unintended locations ## Remediation A fix was released in commit [677651c](https://github.com/evershopcommerce/evershop/commit/677651c67fdee2d8d51a3cf1864826ee523dbc9a), where input validation was implemented to protect against Path Traversal attacks. Users are recommended to upgrade to version 1.0.0-rc.8, which includes this fix. ## Credit This issue was discovered and reported by Checkmarx SCA Security Analyst [Mário Teixeira](https://www.linkedin.com/in/marioleitao-teixeira/). ## Resources 1. [Pull Request](https://github.com/evershopcommerce/evershop/pull/338) 2. [Commit](https://github.com/evershopcommerce/evershop/commit/677651c67fdee2d8d51a3cf1864826ee523dbc9a) 0 Medium Severity CVSS v3.1 Score 4.1 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Changed - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Discovered Mar 17, 2023 2. Disclosed May 18, 2023 The vulnerability was privately disclosed to the maintainer 3. Fixed Sep 26, 2023 A fix commit was released with the vulnerability fix. ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)