CVE-2014-6394

CVE-2014-6394 describes a path traversal vulnerability in visionmedia send before version 0.8.4 for Node.js, affecting various Apple, Fedora, and Joyent products. The flaw stems from an insufficient directory comparison, allowing remote attackers to bypass security checks and access restricted directories outside the intended document root. With a CVSS score of 7.5, this vulnerability is considered high severity, requiring no authentication or complex attack vectors to achieve partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.