7.5

CVE-2025-27210: nodejs node Path Traversal

CVSS: 7.5v3.0HighDeferred
Published 18-07-2025Last modified 04-11-2025
Open JSON

Vulnerability summary

CVE-2025-27210 is a high (CVSS 7.5) Path Traversal vulnerability in nodejs node. EPSS estimates a 15.57% chance of exploitation in the next 30 days, higher than 96.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
43/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.0 (CVE.org)
EPSS score
15.57%
0%100%
Medium · +0.71 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database

Timeline

  1. 18-07-2025
    PublishedVulnerability first disclosed.
  2. 04-11-2025
    Last modifiedVulnerability information updated.

Description

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

15.57%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

+0.71 pp

From 14.87% on 18-09-2026

18-09-202618-10-2026
EPSS score
15.57%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • exploit-databaseremotenodejsUnverified

    NodeJS 24.x - Path Traversal

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Nodejs2 products
  • node≥ 20.0.0, < 20.19.4 | ≥ 22.0.0, < 22.17.1 | ≥ 24.0.0, < 24.4.1
  • node.js≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.* | ≥ 15.0, < 15.* | ≥ 16.0, < 16.* | ≥ 17.0, < 17.* | ≥ 18.0, < 18.* | ≥ 19.0, < 19.*

1 vendor · 2 products

References

2 links