CVE-2021-25864: Dgtl Huemagic

High severity, CVSS 7.5. EPSS: 9.3% chance of exploitation in the next 30 days.

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.

Affected products

• Dgtl Huemagic: version 3.0.0 only

Published 2021-01-26. Last modified 2026-06-17.