CVE-2018-3712

FAUCET Score

CVE-2018-3712 describes a path traversal vulnerability in the "serve" node module prior to version 6.4.9, allowing an authenticated attacker to view arbitrary directory contents. This medium-severity vulnerability (CVSS 6.5) has a low attack complexity and can lead to high confidentiality impact. While no active exploitation or public exploit code is known, and community discussion is minimal, organizations using affected versions should prioritize patching to mitigate this risk.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 6.4.9CPE matchmatch criteria	cpe:2.3:a:zeit:serve::::::node.js::*

CVSS Data

CVSS version used by this source: 3.0

6.5MEDIUM

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

2.8

Impact Score

3.6

CvssVersion

3.0

Exploit Intelligence

EPSS Score

1.79%

Probability of exploitation in next 30 days

EPSS Percentile

76.1%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

This CVE's current EPSS score of 0.0179 is in the 89th percentile among its peer group of 21,951 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

npmpatch availablevia ghsa

Product: serveFixed in: 6.4.9

github_advisoryvendor investigatingvia nvd_reference

View patch

Vendor Advisories (1)

npmGHSA-q2qh-cgc2-qhr3medium

Directory Traversal in serve

Jul 27, 2018

References

github.com / zeit/serve/pull/316

Vendor Advisory

hackerone.com / reports/307666

ExploitTechnical Description