PT-2025-38248 · Esm.Sh · Esm.Sh

J3Ssie · Published 2025-09-17 · Updated 2026-04-17 · CVE-2025-59342

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions esm.sh versions 136 and earlier

Description A path-traversal flaw exists in the handling of the X-Zone-Id HTTP header. The header value is used to construct a filesystem path without proper sanitization or restriction to the application’s storage directory. Supplying ../ sequences in the X-Zone-Id header allows an attacker to write files to arbitrary directories. The vulnerable code is located in router.go at lines 116 and 411. This can lead to arbitrary file creation or overwriting outside the intended storage directory, potentially enabling remote code execution, persistence, or tampering with application files.

Recommendations Remove any .. sequences from the X-Zone-Id header before processing the file.

Exploit

Fix

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2025-59342

GHSA-G2H5-CVVR-7GMW

GO-2025-3967

OPENSUSE-SU-2025:15576-1

SUSE-SU-2025:3799-1

Affected Products

Esm.Sh

References · 53

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59342.json · Exploit
• 🔥 https://exploit-db.com/exploits/52461 · Exploit
• https://osv.dev/vulnerability/GO-2025-3967 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g2h5-cvvr-7gmw · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59342 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15576-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59342 · Vendor Advisory
• https://github.com/esm-dev/esm.sh · Note
• https://github.com/esm-dev/esm.sh/commit/833a29f42aeb0acbd7089a71be11dd0a292d3151 · Note
• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-g2h5-cvvr-7gmw · Note
• https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L411 · Note
• https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L116 · Note
• https://suse.com/security/cve/CVE-2025-61595 · Note
• https://suse.com/security/cve/CVE-2025-59354 · Note