CVE-2018-3729: Path Traversal in localhost-now

The primary impact of this vulnerability is unauthorized file access. An attacker exploiting this Path Traversal flaw could read configuration files, source code, or other sensitive data stored on the server. The extent of the data exposed depends on the file system permissions and the files accessible through the vulnerable endpoint. While the vulnerability is remote, successful exploitation requires the attacker to be able to interact with the localhost-now service over a network connection. This could be a local network or, if the service is exposed to the internet, a wider attack surface.

1. Published2018-07-25
2. Modified2023-11-08
3. EPSS updated2026-04-02

The recommended mitigation for CVE-2018-3729 is to immediately upgrade localhost-now to version 1.0.2 or a later secure version. If upgrading is not immediately feasible, consider implementing strict access controls and file system permissions to limit the potential damage from unauthorized file access. While a direct workaround is not available, restricting network access to the localhost-now service can reduce the attack surface. After upgrading, verify the fix by attempting to access files outside of the intended directory structure through the vulnerable endpoint; access should be denied.