CVE-2016-1000305 json
guard-livereload has a directory traversal vulnerability
published 2026-07-31 3 mo ago modified 2026-07-31 3 mo ago also GHSA-g65v-27r3-5p6m
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
The vulnerability allows remote attackers to read arbitrary files on the server by exploiting improper path validation in the livereload server functionality.
This vulnerability is related to the handling of file paths in the livereload server component, which could allow an attacker to traverse directories and access files outside the intended web root directory.
The issue was identified and reported through the DWF (Distributed Weakness Filing) project, which assigns CVE identifiers for security vulnerabilities.
A directory traversal vulnerability exists in guard-livereload before version 2.5.2.
Patch / fix
- rubygems guard-livereload 2.5.2
- github.com/guard/guard-livereload@0e98469 commit
- github.com/guard/guard-livereload#158 pull request
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | guard-livereload | <2.5.2 |
2.5.2 |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/guard/guard-livereload/pull/158
web
-
github.com
/guard/guard-livereload/commit/0e98469e6b9d81a5bd415781534a23d087c271f8
web
-
github.com
/guard/guard-livereload/issues/159
web
-
github.com
/guard/guard-livereload
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/guard-livereload/CVE-2016-1000305.yml
web
-
security.snyk.io
/vuln/SNYK-RUBY-GUARDLIVERELOAD-20361
web
Sources
- GitHub Advisory GHSA-g65v-27r3-5p6m
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.