CVE-2020-5284: Directory Traversal in Next.js versions below 9.3.2
Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Next.jsto a version that resolves this vulnerability.Fixed in 9.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5284?
CVE-2020-5284 is classified with medium severity due to its potential for directory traversal exploits.
How do I fix CVE-2020-5284?
To fix CVE-2020-5284, upgrade Next.js to version 9.3.2 or later.
What impact does CVE-2020-5284 have on applications?
CVE-2020-5284 allows attackers to access sensitive files in the dist directory (.next) through crafted requests.
Which versions of Next.js are affected by CVE-2020-5284?
Next.js versions prior to 9.3.2 are affected by CVE-2020-5284.
Can CVE-2020-5284 compromise my application?
Yes, CVE-2020-5284 can compromise your application by exposing files in the dist directory to unauthorized access.