CVE-2022-25848

CVE-2022-25848 is a path traversal vulnerability affecting all versions of the static-dev-server package, where user-supplied paths can be improperly joined with the root directory, allowing access to assets outside the intended scope. It carries a CVSS score of 7.5 (HIGH), indicating a network-exploitable vulnerability with low attack complexity, requiring no user interaction, and potentially leading to high confidentiality impact. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.