CVE-2020-15779: Socket.io-File Project Socket.io-File

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path.

Affected products

• Socket.io-File Project Socket.io-File: up to and including 2.0.31

Published 2020-07-15. Last modified 2026-06-17.