PT-2025-38247 · Esm.Sh · Esm.Sh

J3Ssie · Published 2025-09-17 · Updated 2026-05-12 · CVE-2025-59341

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions esm.sh versions prior to 136

Description A Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem or other unintended file sources. The vulnerable code is located in router.go at line 1168. An attacker can exploit this by sending a crafted request to read local files, such as /etc/passwd or esm.db. The vulnerability is triggered by including .. in the URL path.

Recommendations Remove any .. in the URL path before processing the file.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2025-59341

GHSA-49PV-GWXP-532R

GO-2025-3962

OPENSUSE-SU-2025:15576-1

SUSE-SU-2025:3799-1

Affected Products

Esm.Sh

References · 51

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59341.json · Exploit
• https://osv.dev/vulnerability/GHSA-49pv-gwxp-532r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59341 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59341 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15576-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3962 · Vendor Advisory
• https://github.com/esm-dev/esm.sh · Note
• https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168 · Note
• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r · Note
• https://github.com/esm-dev/esm.sh/commit/492de92850dd4d350c8b299af541f87541e58a45 · Note
• https://suse.com/security/cve/CVE-2025-61595 · Note
• https://suse.com/security/cve/CVE-2025-59354 · Note
• https://suse.com/security/cve/CVE-2025-59163 · Note
• https://suse.com/security/cve/CVE-2025-59956 · Note