Security readout for executives and security teams
Plain-English summary
CVE-2017-16120 affects the liyujing Node module, a static file server. The reported flaw lets a remote user request paths containing ../ and potentially read files outside the intended web directory. Business risk depends on whether this package is deployed and reachable by untrusted users.
Executive priority
Prioritize review if any public or partner-accessible service uses liyujing. The package is reported vulnerable in all versions, and the supplied sources do not name a fixed release.
Technical view
The issue is classified as CWE-22 directory traversal. The source bundle says all versions of the liyujing node module are affected, and traversal sequences in URLs can expose filesystem content. No CVSS score, fixed version, or vendor mitigation is provided in the supplied sources.
Likely exposure
Exposure is limited to systems that use the liyujing npm package as a static file server, especially Internet-facing or internal services reachable by untrusted users.
Exploitation context
The bundle does not show CISA KEV listing or confirmed active exploitation. Public references include an advisory and a proof-of-concept repository, so defenders should assume the flaw is publicly known.
Researcher notes
Evidence is sparse: the CVE description, CWE-22 classification, all-version affected range, and references support directory traversal risk. The bundle does not provide CVSS, patch details, exploit prevalence, or affected deployment patterns.
Mitigation direction
- Inventory applications for the liyujing npm package.
- Remove or replace liyujing where possible.
- Check the Node Security advisory and vendor guidance for any maintained remediation.
- Restrict network access to any service still using liyujing.
- Run the service with least-privilege filesystem permissions.
Validation and detection
- Search dependency manifests and lockfiles for liyujing.
- Identify running static file services backed by this module.
- Confirm exposed services cannot read files outside the intended web root.
- Review web logs for suspicious traversal-pattern requests.
- Verify filesystem permissions limit readable sensitive files.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-16120 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/JacksonGL/NPM-Vuln-PoC/tree/master/directory-traversal/liyujingCVE reference · x_refsource_MISC
- https://nodesecurity.io/advisories/387CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.