Sploitus

Exploit for CVE-2025-27210

githubexploit · 2025-07-16

Exploit Code

README20 lines
## https://sploitus.com/exploit?id=6071BF1E-880A-5DE6-87ED-128D58139ABC
# CVE-2025-27210_NodeJS_Path_Traversal_Exploiter

Proof of Concept CVE-2025-27210, a precise Path Traversal vulnerability affecting Node.js applications running on Microsoft Windows. This vulnerability leverages the specific way Windows handles reserved device file names (e.g., AUX, CON, NUL) when combined with directory traversal sequences (../) within file paths processed by functions like path.join() or path.normalize().


```
python CVE-2025-27210_NodeJS_Path_Traversal_Exploiter.py  -t http://localhost:3000/download -f C:\\Windows\System32\drivers\etc\hosts
```

--------------------------------------------------------------------------------
![Node.js](poc1.jpg)
--------------------------------------------------------------------------------
![Node.js](poc(2).jpg)


The vulnerability was reported by:
@theoblivionsage
https://x.com/theoblivionsage
| https://hackerone.com/oblivionsage