Security readout for executives and security teams
Plain-English summary
CVE-2017-16186 affects the 360class.jansenhm Node module, a static file server. It may let a remote user request files outside the intended web directory through directory traversal. Business risk depends on whether this obsolete package is used on any reachable service and what local files that service can read.
Executive priority
Treat this as a targeted dependency exposure check, not an enterprise-wide emergency. Prioritize quickly if the package appears in internet-facing systems or systems with access to secrets, configuration files, or customer data.
Technical view
The CVE describes a CWE-22 directory traversal flaw in all versions of the 360class.jansenhm node module. The source states attackers can access the filesystem by placing traversal sequences in the URL. No CVSS score, patch version, or maintained remediation path is provided in the bundle.
Likely exposure
Exposure is limited to applications or services that use the 360class.jansenhm Node module as a static file server. Risk is higher if the service is internet-facing or runs with filesystem access to sensitive configuration, source, or credential files.
Exploitation context
The bundle includes a public proof-of-concept reference and an old Node Security advisory. CISA KEV is false, and the supplied sources do not state active exploitation in the wild. Do not assume exploitation without local evidence.
Researcher notes
Evidence is sparse: all versions are listed as affected, but the bundle provides no CVSS vector, fixed version, or exploit-in-the-wild confirmation. The key research task is dependency discovery, reachability analysis, and filesystem impact assessment.
Mitigation direction
- Inventory applications for the 360class.jansenhm package in manifests and lockfiles.
- Check the referenced advisory and package repository for vendor guidance or maintained replacements.
- Remove or replace the package where feasible, especially on public-facing services.
- Limit filesystem permissions for any service that still depends on this module.
- Restrict external access to affected services until remediation is complete.
Validation and detection
- Search dependency manifests, lockfiles, and deployed artifacts for 360class.jansenhm.
- Map any matching service to public routes and static file handling paths.
- Review runtime permissions for files readable by the affected service account.
- Review access logs for attempted directory traversal indicators against affected services.
- Confirm remediation by verifying the package is removed, replaced, or isolated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-16186 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/360class.jansenhmCVE reference · x_refsource_MISC
- https://nodesecurity.io/advisories/448CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.