{"id":"CVE-2020-5284","published":"2020-03-30T20:40:11Z","modified":"2024-08-04T08:22:09Z","title":"Directory Traversal in Next.js versions below 9.3.2","vendor":"zeit","product":"next.js","tier":"core","eol":null,"affectedVersions":[{"vendor":"zeit","product":"next.js","versions":["< 9.3.2"]}],"description":{"text":"Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.","provenance":"source","from":"CVE.org"},"summary":{"text":"A directory traversal flaw in zeit's Next.js framework (versions before 9.3.2) lets crafted requests reach files within the dist (.next) build directory. An attacker needs network access to the application and low privileges, plus user interaction, and exploitation is hard to achieve, with the exposure limited to build assets unless the application deliberately stores other content there.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:47Z"},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.44776,"percentile":0.98769,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-03-23","exploitedFirstSeen":"2026-03-23","ransomware":false,"evidence":[{"url":"https://www.labs.greynoise.io/grimoire/2026-03-23-bucklog-k8s/","date":"2026-03-23"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/zeit/next.js/releases/tag/v9.3.2","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[{"ecosystem":"npm","package":"next","vulnerableRanges":[">=0.9.9, <9.3.2"],"patched":["9.3.2"],"from":["GHSA-fq77-7p7r-83rj"],"provenance":"source"}],"advisories":[{"id":"GHSA-fq77-7p7r-83rj","url":"https://github.com/advisories/GHSA-fq77-7p7r-83rj","severity":"MODERATE","ecosystem":"npm","package":"next","vulnerableRanges":[">=0.9.9, <9.3.2"],"patched":["9.3.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2020-0342","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0342","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2020-5284","name":"Next.js <9.3.2 - Local File Inclusion","severity":"medium","path":"http/cves/2020/CVE-2020-5284.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5284.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1005"],"provenance":"source"}],"timeline":[{"date":"2020-03-30","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-5284","provenance":"source"},{"date":"2026-03-23","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.labs.greynoise.io/grimoire/2026-03-23-bucklog-k8s/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":67.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 220 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.75,"detail":"percentile 0.9877"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.08,"detail":"base score 4.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}