{"id":"GHSA-jgqf-hwc5-hh37","revision":"7d00a339172d4a8987c15d5299b71dcb","records":[{"revision":"7d00a339172d4a8987c15d5299b71dcb","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-jgqf-hwc5-hh37","aliases":["CVE-2015-8859"],"title":"Root Path Disclosure in send","description":"Versions of `send` prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.\n\n\n\n## Recommendation\n\nUpdate to version 0.11.1 or later.","state":0,"publishedAt":"2017-10-24T18:33:36+00:00","modifiedAt":"2023-11-08T03:58:03.684961+00:00","affected":[{"ecosystem":"npm","name":"send","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.11.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2015-8859","https://github.com/pillarjs/send/pull/70","https://github.com/pillarjs/send/commit/98a5b89982b38e79db684177cf94730ce7fc7aed","https://github.com/expressjs/serve-static/blob/master/HISTORY.md#181--2015-01-20","https://github.com/pillarjs/send","https://web.archive.org/web/20200227192016/https://www.securityfocus.com/bid/96435","http://www.openwall.com/lists/oss-security/2016/04/20/11"],"sourceUrl":"https://github.com/advisories/GHSA-jgqf-hwc5-hh37","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jgqf-hwc5-hh37","identifiers":["GHSA-jgqf-hwc5-hh37","CVE-2015-8859"]},"retained":false,"historicalAffected":[]}],"coverage":[]}