CVE-2014-6394

⚠️ high

Summary

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.

CVSS Score

7.5

High

EPSS Score

4.3

Exploit Probability

Published Date

2014-10-08

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.9% of all 335,187 vulnerabilities in our database.

#104,397

Above average severity

Severity Percentile

Last Modified 2026-06-17

Source NVD 🔗

CWE IDs (Weakness Types)

CWE-22

📦 Affected Products 8

Vendor	Product	Status	Affected Versions
apple	xcode	Affected	v7.0
fedoraproject	fedora	Affected	v19
fedoraproject	fedora	Affected	v20
fedoraproject	fedora	Affected	v21
joyent	node.js	Affected	≤ 0.8.3
joyent	node.js	Affected	v0.8.0
joyent	node.js	Affected	v0.8.1
joyent	node.js	Affected	v0.8.2

🔗 References 15

http://lists.apple.com/archives/security-announce/20...

http://lists.fedoraproject.org/pipermail/package-ann...

http://secunia.com/advisories/62170

http://www-01.ibm.com/support/docview.wss?uid=swg216...

http://www.openwall.com/lists/oss-security/2014/09/24/1

http://www.openwall.com/lists/oss-security/2014/09/3...

http://www.securityfocus.com/bid/70100

https://bugzilla.redhat.com/show_bug.cgi?id=1146063

https://exchange.xforce.ibmcloud.com/vulnerabilities...

https://github.com/visionmedia/send/commit/9c6ca9b2c...

Exploit

https://github.com/visionmedia/send/pull/59

https://nodesecurity.io/advisories/send-directory-tr...

https://support.apple.com/HT205217

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-54230	⚠️ high	7.0	0.1	A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts wr...	2026-06-13
CVE-2026-54231	🔶 medium	5.5	0.1	A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script...	2026-06-13
CVE-2026-35093	⚠️ high	8.8	0.2	A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or ...	2026-04-01
CVE-2026-35094	ℹ️ low	3.3	0.0	A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can expl...	2026-04-01
CVE-2026-28889	🔶 medium	6.2	0.0	A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to...	2026-03-25
CVE-2026-28890	🔶 medium	5.5	0.0	An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able...	2026-03-25

These CVEs affect the same products