CVE-2025-59342: esm-dev esm.sh Path Traversal: '../filedir'

Vulnerability summary

CVE-2025-59342 is a medium (CVSS 5.5) Path Traversal: '../filedir' vulnerability in esm-dev esm.sh. EPSS estimates a 3.01% chance of exploitation in the next 30 days, higher than 87.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 17-09-2025
   PublishedVulnerability first disclosed.
2. 14-01-2026
   Last modifiedVulnerability information updated.

Description

esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Version 136.1 contains a patch.

• CWE-24Path Traversal: '../filedir'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.