CVE-2025-59342
CVE-2025-59342 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-24.
Key facts
- Severity: Medium (CVSS 4.0 base score 5.5)
- EPSS exploit prediction: 3% (85th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-29764
- Weakness: CWE-24
- Published:
- Last modified:
Description
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Version 136.1 contains a patch.
Frequently asked questions
- What is CVE-2025-59342?
- esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Version 136.1 contains a patch.
- How severe is CVE-2025-59342?
- CVE-2025-59342 has a CVSS 4.0 base score of 5.5, rated medium severity.
- Is CVE-2025-59342 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (85th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-59342?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-59342 have an EU (EUVD) identifier?
- Yes. CVE-2025-59342 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-29764.
- When was CVE-2025-59342 published?
- CVE-2025-59342 was published on 2025-09-17 and last updated on 2026-06-17.
References
- https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L116
- https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L411
- https://github.com/esm-dev/esm.sh/commit/833a29f42aeb0acbd7089a71be11dd0a292d3151
- https://github.com/esm-dev/esm.sh/security/advisories/GHSA-g2h5-cvvr-7gmw
Other CWE-24 vulnerabilities
- CVE-2026-39813 — Critical (CVSS 9.8): A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through…
- CVE-2026-49103 — Critical (CVSS 9.4): Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component.…
- CVE-2025-61318 — Critical (CVSS 9.1): Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php…
- CVE-2023-6699 — Critical (CVSS 9.1): The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all…
- CVE-2025-54769 — High (CVSS 8.8): An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed…
- CVE-2025-60344 — High (CVSS 8.6): A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote…