{"id":"CVE-2026-116673","published":"2026-10-27T16:38:15Z","modified":"2026-10-28T16:15:47Z","title":"systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net","vendor":"sebhildebrandt","product":"systeminformation","tier":"tail","description":{"text":"systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.3,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00127,"percentile":0.0236,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-59","name":"Improper Link Resolution Before File Access"}],"references":[{"url":"https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4vjg-vx72-qq4g","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/sebhildebrandt/systeminformation/commit/8d294b3139fec654a912969ac898037578a218cd","tags":["x_refsource_MISC"]},{"url":"https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.14","tags":["x_refsource_MISC"]}],"priority":{"score":2.8,"factors":[{"name":"EPSS percentile","points":0.47},{"name":"CVSS severity","points":2.31}]},"vendorSlug":"sebhildebrandt","affectedVersions":[{"vendor":"sebhildebrandt","product":"systeminformation","versions":["< 5.33.14"]}],"affected":[{"ecosystem":"npm","package":"systeminformation","vulnerableRanges":["<5.33.14"],"patched":["5.33.14"],"from":["GHSA-4vjg-vx72-qq4g"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-111101","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2026-44724","published":"2026-05-27","fixed":"5.31.6","kev":false},{"cve":"CVE-2026-50289","published":"2026-07-17","fixed":"5.31.7","kev":false},{"cve":"CVE-2026-116674","published":"2026-10-27","fixed":"5.33.13","kev":false,"link":{"from":"CVE-2026-116674","to":"CVE-2026-116673","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:systeminformation","fromFixed":"5.33.13","toFixed":"5.33.14","daysApart":0}]}},{"cve":"CVE-2026-116673","published":"2026-10-27","fixed":"5.33.14","kev":false},{"cve":"CVE-2026-116576","published":"2026-10-26","fixed":"5.33.16","kev":false,"link":{"from":"CVE-2026-116673","to":"CVE-2026-116576","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:systeminformation","fromFixed":"5.33.14","toFixed":"5.33.16","daysApart":-1}]}}],"package":"npm:systeminformation"}}