CVE-2022-25931

CVE-2022-25931 is a directory traversal vulnerability affecting all versions of the easy-static-server package. It stems from insufficient input sanitization and sandboxing of the req.url user input, allowing attackers to access arbitrary files and directories outside the intended web root. With a CVSS score of 7.5 (High), this vulnerability can be exploited remotely with low attack complexity and no user interaction, leading to high confidentiality impact. Despite its severity, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.