Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2025-59341
CVE-2025-59341:
vulnerability analysis and mitigation
Overview
A Local File Inclusion (LFI) vulnerability was discovered in esm.sh, a nobuild content delivery network (CDN) for modern web development, identified as CVE-2025-59341. The vulnerability was disclosed on September 17, 2025, affecting versions 136 and earlier of the esm.sh service. The issue lies in the URL handling mechanism where attackers could craft specific requests to access and retrieve files from the host filesystem (GitHub Advisory).
Technical details
The vulnerability is classified as CWE-23 (Relative Path Traversal) and received a CVSS v4.0 score of 7.7 (High) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. The vulnerable code is located in the server/router.go file at line 1168, where the application directly opens files without properly sanitizing the file path input (GitHub Advisory).
Impact
The vulnerability allows attackers to read configuration files, private keys, environment files, and other sensitive files from the system. This can lead to the disclosure of secrets, credentials, and potentially enable further attacks through information leakage (GitHub Advisory).
Mitigation and workarounds
The recommended remediation is to remove any '..' sequences in the URL path before processing the file. As of the disclosure date, no patched versions are available (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management