Default swagger-ui configuration exposes all files in the module
28Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 5.3epss 2.0%
exploitation probability
2.0%top 21% of all CVEs
observed exploitation
nono source reports it
In short
The fastify-swagger-ui plugin exposes all files in its directory through HTTP by default, allowing attackers to access sensitive files that should be private. Updating to version 2.1.0 or configuring the baseDir option fixes this issue.
Technical detail
fastify-swagger-ui versions prior to 2.1.0 lack proper path restriction in the default configuration, enabling directory traversal attacks where HTTP requests can retrieve arbitrary files from the module directory. This requires the plugin to be active with default settings, and impacts confidentiality by exposing source code, configuration, and other sensitive module files.
Summary generated and translated by AI from the official description.
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
fastify · fastify-swagger-ui