Medium severity · published Sep 17, 2025
CVE-2025-59342
esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header
5.5
CVSS
3.2%
EPSS
No
On KEV
Description
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Version 136.1 contains a patch.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
esm.sh · esm-dev
<= 136 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59342
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59342
github.com
https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L116
github.com
https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L411
github.com
https://github.com/esm-dev/esm.sh/commit/833a29f42aeb0acbd7089a71be11dd0a292d3151
github.com
https://github.com/esm-dev/esm.sh/security/advisories/GHSA-g2h5-cvvr-7gmw
More from esm.sh
9.8
CVE-2025-65025
esm.sh CDN service has arbitrary file write via tarslip
9.6
CVE-2025-65026
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript
8.7
CVE-2026-44593
esm.sh: Legacy Route Path Traversal Can Lead to RCE
7.7
CVE-2025-59341
Local File Inclusion in esm.sh
7.5
CVE-2026-44594
esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files