Description

esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application directory. URL-encoded dot segments such as %2e%2e bypass the plain traversal redirect performed by Go's ServeMux, allowing an unauthenticated remote attacker to make the server open and return files outside Config.AppDir that are readable by the server process. The confirmed impact is file disclosure only, and the issue is reachable with Dev disabled. This issue is fixed in server version 137_7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T21:17:05.863Z",
  "pubdate": "2026-11-06T21:17:05.863Z",
  "executiveSummary": "A critical path traversal vulnerability exists in the esm.sh CDN server, specifically within the web.NewHandler component.\nThe vulnerability allows an unauthenticated remote attacker to bypass path restriction mechanisms to access arbitrary files on the host filesystem that are readable by the server process.\nThis occurs because the application fails to adequately sanitize URL-encoded path inputs, specifically dot-dot (%2e%2e) sequences, before joining them with the configured application root directory.\nThe flaw affects versions prior to 137_7 and enables unauthorized file disclosure.\nSuccessful exploitation allows for the reading of sensitive system or configuration files, potentially leading to further compromise depending on the information exposed.\nThe vulnerability is reachable even when the Dev feature is disabled, making it a significant security risk for production environments.",
  "technicalDetails": "The vulnerability resides in the web.NewHandler function within web/handler.go, which is responsible for serving static files in the esm.sh infrastructure.\nThe root cause is an improper validation of file system paths. The application utilizes Go's ServeMux to route requests; however, while Go's native routing performs a plain traversal redirect, it does not account for URL-encoded representations of path traversal sequences.\nAn attacker can leverage this by submitting crafted HTTP requests containing URL-encoded dot segments such as %2e%2e/ (dot-dot-slash) in the r.URL.Path.\nBecause the server decodes the URL and subsequently joins the resulting path with the Config.AppDir without performing a canonicalization check or verifying that the final resulting path resides within the intended root directory, the server resolves to a location outside the application's intended scope.\nThe attack flow proceeds as follows: An attacker sends an HTTP GET request to the esm.sh server. The request path is manipulated to include encoded traversal sequences. The vulnerable web.NewHandler component processes the request by appending the malicious path to the Config.AppDir. Due to the lack of boundary checking (e.g., verifying the absolute path prefix), the filesystem API accesses the directory outside the intended root. The server then reads the target file and returns its contents in the HTTP response body to the attacker.\nThis vulnerability does not require authentication or elevated privileges, as the static file handler is exposed to any remote user capable of reaching the server. The impact is strictly limited to unauthorized file disclosure, which is determined by the filesystem permissions assigned to the user context running the esm.sh process.\nThis flaw is present in all versions prior to 137_7. The inability of the handler to resolve the final path and ensure it remains confined to the specified directory constitutes a classic Path Traversal (CWE-22) scenario."
}