5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-8115

CVE-2026-8115: short-video-maker has a path traversal vulnerability

A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. This affects an unknown part of the file src/server/routers/rest.ts of the component REST API. The manipulation of the argument req.params.tmpFile results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-8115

CVE-2026-8115:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
short-video-maker	npm	<= 1.3.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal flaw located in the REST API of the short-video-maker application. The root cause lies within the APIRouter.setupRoutes method in src/server/routers/rest.ts. This method defines two Express.js route handlers for the endpoints /api/tmp/:tmpFile and /api/music/:fileName.

Both handlers accept a parameter from the URL (tmpFile and fileName, respectively) and directly use it to construct a file path on the server's filesystem using path.join. The critical flaw is the lack of input sanitization or path normalization. The application does not validate whether the resolved path is within the intended base directories (tempDirPath and musicDirPath).

As a result, an attacker can send a crafted HTTP request containing path traversal sequences (e.g., ..%2f which decodes to ../) to navigate the file system and access sensitive files readable by the server process, such as /etc/passwd. The vulnerable code then reads the file using fs.createReadStream and streams its content back to the attacker. Since the vulnerability is in unpatched, publicly known code, any instance of short-video-maker version 1.3.4 or older is susceptible to this remote attack.

Vulnerable functions

APIRouter.setupRoutes

src/server/routers/rest.ts

The vulnerability exists within an anonymous route handler for the GET endpoint `/api/tmp/:tmpFile`, which is defined inside the `setupRoutes` method. The handler takes the `tmpFile` parameter from the URL and uses `path.join` to create a file path. It does not sanitize the input, allowing path traversal characters like `../`. This allows an attacker to read arbitrary files on the system by crafting a malicious URL (e.g., `/api/tmp/..%2f..%2fetc%2fpasswd`). The `fs.createReadStream` call then reads and streams the content of the unauthorized file.

APIRouter.setupRoutes

src/server/routers/rest.ts

Similar to the `/api/tmp/:tmpFile` endpoint, the anonymous route handler for GET `/api/music/:fileName` is also vulnerable to path traversal. This handler is also defined within the `setupRoutes` method. It uses the unsanitized `fileName` parameter from the URL to construct a file path with `path.join`. An attacker can exploit this to read files outside the intended music directory by supplying traversal sequences in the `fileName` parameter.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.