CVE-2014-6394

⚠️ high

Summary

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.

CVSS Score

7.5

High

EPSS Score

4.8

Exploit Probability

Published Date

2014-10-08

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.4% of all 317,883 vulnerabilities in our database.

#97,299

Above average severity

Severity Percentile

Last Modified 2025-04-12

Source NVD 🔗

CWE IDs (Weakness Types)

CWE-22

📦 Affected Products 8

Vendor	Product	Status	Affected Versions
apple	xcode	Affected	v7.0
fedoraproject	fedora	Affected	v19
fedoraproject	fedora	Affected	v20
fedoraproject	fedora	Affected	v21
joyent	node.js	Affected	≤ 0.8.3
joyent	node.js	Affected	v0.8.0
joyent	node.js	Affected	v0.8.1
joyent	node.js	Affected	v0.8.2

🔗 References 15

http://lists.apple.com/archives/security-announce/20...

http://lists.fedoraproject.org/pipermail/package-ann...

http://secunia.com/advisories/62170

http://www-01.ibm.com/support/docview.wss?uid=swg216...

http://www.openwall.com/lists/oss-security/2014/09/24/1

http://www.openwall.com/lists/oss-security/2014/09/3...

http://www.securityfocus.com/bid/70100

https://bugzilla.redhat.com/show_bug.cgi?id=1146063

https://exchange.xforce.ibmcloud.com/vulnerabilities...

https://github.com/visionmedia/send/commit/9c6ca9b2c...

Exploit

https://github.com/visionmedia/send/pull/59

https://nodesecurity.io/advisories/send-directory-tr...

https://support.apple.com/HT205217

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2025-31186	ℹ️ low	3.3	0.0	A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to...	2026-01-16
CVE-2025-43504	🔶 medium	4.9	0.1	A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged...	2025-11-04
CVE-2025-43505	⚠️ high	8.8	0.1	An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing...	2025-11-04
CVE-2025-43263	⚠️ high	7.1	0.0	The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write file...	2025-09-15
CVE-2025-43370	🔶 medium	4.0	0.0	A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly larg...	2025-09-15
CVE-2025-43371	⚠️ high	8.2	0.0	This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its s...	2025-09-15

These CVEs affect the same products