CVE-2025-27210
Published: 18 July 2025
Summary
CVE-2025-27210 is a high-severity Path Traversal (CWE-22) vulnerability in Nodejs (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-27210 is an incomplete remediation of the earlier path-handling flaw CVE-2025-23084 in Node.js. The issue specifically affects the path.join API when used on Windows, where reserved device names such as CON, PRN, and AUX are not properly sanitized, leaving a path-traversal vector (CWE-22) that can expose file contents.
An unauthenticated remote attacker can supply crafted path segments to path.join calls over the network, resulting in disclosure of sensitive files with no user interaction required. The vulnerability carries a CVSS 7.5 score reflecting its high confidentiality impact and ease of exploitation against any Windows-based Node.js application that processes untrusted input through this API.
The official Node.js July 2025 security releases and the accompanying oss-security advisory describe the corrected handling and urge administrators to upgrade to the patched versions that fully address the device-name bypass.
EPSS for the CVE rose from a low baseline to a recorded peak of 0.0923, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21939
Vulnerability details
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users of `path.join` API.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.