Vulnerability record · CVE-2019-8903 · published 18 February 2019
CVE-2019-8903: Total.js Platform path traversal in index.js
Totaljs · Total.Js
Total.js Platform before 3.2.3 contains a path traversal flaw in index.js, allowing crafted requests to reach files outside the intended directory. The issue is remotely reachable without authentication and is rated HIGH (CVSS 7.5), with a very high EPSS score indicating likely exploitation activity.
Description
index.js in Total.js Platform before 3.2.3 allows path traversal.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityRemote, unauthenticated file disclosure with a HIGH CVSS score and very high EPSS probability warrants prompt patching.
What it is
Total.js Platform before 3.2.3 contains a path traversal flaw in index.js, allowing crafted requests to reach files outside the intended directory. The issue is remotely reachable without authentication and is rated HIGH (CVSS 7.5), with a very high EPSS score indicating likely exploitation activity.
Impact
An attacker can read arbitrary files on the server, exposing configuration, credentials, and source code. The CVSS vector shows confidentiality impact only, with no integrity or availability effect.
Attack surface
Reachable over the network via HTTP requests to the affected index.js handling; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.72058 (99.4th percentile), suggesting high likelihood of exploitation; references include patch commits and a third-party advisory, with no public exploit tag.
What to do
- Upgrade Total.js Platform to 3.2.3 or later, applying the referenced patch commits.
- If immediate upgrade is not possible, restrict or block external access to the affected application until patched.
- Validate and normalize all file path inputs, rejecting traversal sequences such as ../.
- Run the application with least privilege so file reads are limited to non-sensitive paths.
- Monitor for anomalous file access patterns from the web tier.
Detection
- Inspect web server and application logs for requests containing ../ or encoded traversal sequences.
- Alert on file reads by the Total.js process outside expected application directories.
- Use file integrity or access monitoring to flag reads of sensitive files (e.g., config, credential stores) by the web process.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-8903 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-8903), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
