---
title: "GHSA-jgqf-hwc5-hh37: Root Path Disclosure in send"
description: "Moderate severity. Root Path Disclosure in send. Affects send; fixed in 0.11.1."
url: https://inlinr.com/advisories/GHSA-jgqf-hwc5-hh37
lang: en
---

[Packages](https://inlinr.com/packages) / [send](https://inlinr.com/packages/send) / [Security](https://inlinr.com/packages/send/security)

Moderate Vulnerability GHSA-jgqf-hwc5-hh37 CVE-2015-8859 Published 24 Oct 2017

# Root Path Disclosure in send

Your version 

Affected releases · [send](https://inlinr.com/packages/send)

- 0.11.x 0.11.0 Fixed in 0.11.1
- 0.10.x and older 0.0.1 – 0.10.1 No fix, no longer updated

On 0.11.x, the newest line:

```
npm install send@0.11.1
```

Every release on a timeline

1.x 

1. Not affected

1.0.0 – 1.2.1  
4 releases, latest

0.x 

1. Affected

0.0.1 – 0.11.0  
35 releases
2. Fixed

0.11.1 – 0.19.2  
28 releases

67 stable releases of send, oldest to newest, one row per major.

## What happens

Versions of `send` prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.

Recommendation

Update to version 0.11.1 or later.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: low
- **Integrity**: none
- **Availability**: none

CVSS:3.0/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:L/​I:N/​A:N

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-8859 "https://nvd.nist.gov/vuln/detail/CVE-2015-8859")  
nvd.nist.gov/vuln/detail/CVE-2015-8859
- [Pull request](https://github.com/pillarjs/send/pull/70 "https://github.com/pillarjs/send/pull/70")  
#70
- [Fix commit](https://github.com/pillarjs/send/commit/98a5b89982b38e79db684177cf94730ce7fc7aed "https://github.com/pillarjs/send/commit/98a5b89982b38e79db684177cf94730ce7fc7aed")  
98a5b89
- [Reference](https://github.com/expressjs/serve-static/blob/master/HISTORY.md#181--2015-01-20 "https://github.com/expressjs/serve-static/blob/master/HISTORY.md#181--2015-01-20")  
github.com/expressjs/serve-static/blob/master/H…
- [Package](https://github.com/pillarjs/send "https://github.com/pillarjs/send")  
github.com/pillarjs/send
- [Reference](https://web.archive.org/web/20200227192016/https://www.securityfocus.com/bid/96435 "https://web.archive.org/web/20200227192016/https://www.securityfocus.com/bid/96435")  
web.archive.org/web/20200227192016/https://www.…
- [Reference](http://www.openwall.com/lists/oss-security/2016/04/20/11 "http://www.openwall.com/lists/oss-security/2016/04/20/11")  
openwall.com/lists/oss-security/2016/04/20/11