IPX is Vulnerable to Path Traversal via Prefix Matching Bypass
Description
IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison. This is fixed in versions 1.3.2, 2.1.1 and 3.1.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
IPX image optimizer path prefix bypass allows reading files outside allowed directories due to missing trailing separator in path check.
Vulnerability
Description
The IPX image optimizer, which uses sharp and svgo, contains a path traversal vulnerability in its directory access control. The check to verify whether a requested path is within allowed directories uses a raw string prefix comparison. When the allowed directory path does not end with a path separator (e.g., /allowedDir instead of /allowedDir/), an attacker can bypass the restriction by appending characters such as ../ to escape the intended directory. This affects versions 1.3.1 and below, 2.0.0 through 2.1.0, and 3.0.0 through 3.1.0 [1].
Exploitation
An attacker can exploit this by crafting a URL that starts with the allowed directory prefix but then uses path traversal sequences to navigate to arbitrary files. For example, if the allowed directory is /images, a request to /images../etc/passwd would pass the prefix check because /images is a prefix of /images../etc/passwd. No authentication is required if the IPX server is exposed to the network, making this a low-complexity attack [1][2].
Impact
Successful exploitation allows an attacker to read any file on the filesystem that the server process has access to, potentially exposing sensitive configuration files, credentials, or user data. This can lead to further compromise of the application or server [1].
Mitigation
The vulnerability has been patched in versions 1.3.2, 2.1.1, and 3.1.1 [3][4]. Users are strongly advised to upgrade to these fixed versions immediately. No workarounds are documented; the fix ensures that allowed directory paths are normalized and that the check uses proper path resolution rather than simple string prefix matching.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ipxnpm | < 1.3.2 | 1.3.2 |
ipxnpm | >= 2.0.0-0, < 2.1.1 | 2.1.1 |
ipxnpm | >= 3.0.0, < 3.1.1 | 3.1.1 |
Affected products
2- unjs/ipxv5Range: < 1.3.2
Patches
181693ddbfc06fix(fs): ensure path stays within the exact directory (#271)
3 files changed · +22 −1
src/storage/node-fs.ts+1 −1 modified@@ -43,7 +43,7 @@ export function ipxFSStorage(_options: NodeFSSOptions = {}): IPXStorage { const fs = await _getFS(); for (const dir of dirs) { const filePath = join(dir, id); - if (!isValidPath(filePath) || !filePath.startsWith(dir)) { + if (!isValidPath(filePath) || !filePath.startsWith(dir + "/")) { throw createError({ statusCode: 403, statusText: `IPX_FORBIDDEN_PATH`,
test/fs-dirs.test.ts+12 −0 modified@@ -51,3 +51,15 @@ describe("ipx: fs with multiple dirs", () => { ); }); }); + +describe("isolation", () => { + it("should not be able to access files outside the specified directories", async () => { + const ipx = createIPX({ + storage: ipxFSStorage({ + dir: fileURLToPath(new URL("assets", import.meta.url)), + }), + }); + const source = await ipx("../assets2/bliss.jpg"); // access file outside ./public dir because of same prefix folder + await expect(source.process()).rejects.toThrowError("Forbidden path"); + }); +});
test.mjs+9 −0 added@@ -0,0 +1,9 @@ +import { createIPX, ipxFSStorage } from "ipx"; + +const ipx = createIPX({ + storage: ipxFSStorage({ dir: "./test/assets" }), +}); + +const source = await ipx("../assets2/bliss.jpg"); // access file outside ./public dir because of same prefix folder +const { data, format } = await source.process(); +console.log(format); // print image format
Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
7- github.com/advisories/GHSA-mm3p-j368-7jcrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-54387ghsaADVISORY
- github.com/unjs/ipx/commit/81693ddbfc062cc922e4e2406e8427ab4e3ad214ghsax_refsource_MISCWEB
- github.com/unjs/ipx/releases/tag/v1.3.2ghsax_refsource_MISCWEB
- github.com/unjs/ipx/releases/tag/v2.1.1ghsax_refsource_MISCWEB
- github.com/unjs/ipx/releases/tag/v3.1.1ghsax_refsource_MISCWEB
- github.com/unjs/ipx/security/advisories/GHSA-mm3p-j368-7jcrghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.