{"id":"CVE-2020-5284","details":"Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.","aliases":["GHSA-fq77-7p7r-83rj"],"modified":"2026-08-27T08:14:23.041969Z","published":"2020-03-30T22:15:15.400Z","references":[{"type":"ADVISORY","url":"https://github.com/zeit/next.js/releases/tag/v9.3.2"},{"type":"ADVISORY","url":"https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7p7r-83rj"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vercel/next.js","events":[{"introduced":"0"},{"fixed":"ee0081356d7ea166dfed4765f134730c11ecaecf"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"9.3.2"}]}}],"versions":["v9.3.2-canary.9","v9.3.2-canary.8","v9.3.2-canary.7","v9.3.2-canary.6","v9.3.2-canary.5","v9.3.2-canary.4","v9.3.2-canary.3","v9.3.2-canary.2","v9.3.2-canary.1","v9.3.2-canary.0","v9.3.1","v9.3.1-canary.7","v9.3.1-canary.6","v9.3.1-canary.5","v9.3.1-canary.4","v9.3.1-canary.3","v9.3.1-canary.2","v9.3.1-canary.1","v9.3.1-canary.0","v9.3.0","v9.2.3-canary.29","v9.2.3-canary.28","v9.2.3-canary.27","v9.2.3-canary.26","v9.2.3-canary.25","v9.2.3-canary.24","v9.2.3-canary.23","v9.2.3-canary.22","v9.2.3-canary.21","v9.2.3-canary.20","v9.2.3-canary.19","v9.2.3-canary.18","v9.2.3-canary.17","v9.2.3-canary.16","v9.2.3-canary.15","v9.2.3-canary.14","v9.2.3-canary.13","v9.2.3-canary.12","v9.2.3-canary.11","v9.2.3-canary.10","v9.2.3-canary.9","v9.2.3-canary.8","v9.2.3-canary.7","v9.2.3-canary.6","v9.2.3-canary.5","v9.2.3-canary.4","v9.2.3-canary.3","v9.2.3-canary.2","v9.2.3-canary.1","v9.2.3-canary.0","v9.2.2","v9.2.2-canary.23","v9.2.2-canary.22","v9.2.2-canary.21","v9.2.2-canary.20","v9.2.2-canary.19","v9.2.2-canary.18","v9.2.2-canary.17","v9.2.2-canary.16","v9.2.2-canary.15","v9.2.2-canary.14","v9.2.2-canary.13","v9.2.2-canary.12","v9.2.2-canary.11","v9.2.2-canary.10","v9.2.2-canary.9","v9.2.2-canary.8","v9.2.2-canary.7","v9.2.2-canary.6","v9.2.2-canary.5","v9.2.2-canary.4","v9.2.2-canary.3","v9.2.2-canary.2","v9.2.2-canary.1","v9.2.2-canary.0","v9.2.1","v9.2.1-canary.11","v9.2.1-canary.10","v9.2.1-canary.9","v9.2.1-canary.8","v9.2.1-canary.7","v9.2.1-canary.6","v9.2.1-canary.5","v9.2.1-canary.4","v9.2.1-canary.3","v9.2.1-canary.2","v9.2.1-canary.1","v9.2.1-canary.0","v9.2.0","v9.1.8-canary.17","v9.1.8-canary.16","v9.1.8-canary.15","v9.1.8-canary.14","v9.1.8-canary.13","v9.1.8-canary.12","v9.1.8-canary.11","v9.1.8-canary.10","v9.1.8-canary.9","v9.1.8-canary.8","v9.1.8-canary.7","v9.1.8-canary.6","v9.1.8-canary.5","v9.1.8-canary.4","v9.1.8-canary.3","v9.1.8-canary.2","v9.1.8-canary.1","v9.1.8-canary.0","v9.1.7","v9.1.7-canary.16","v9.1.7-canary.15","v9.1.7-canary.14","v9.1.7-canary.13","v9.1.7-canary.12","v9.1.7-canary.11","v9.1.7-canary.10","v9.1.7-canary.9","v9.1.7-canary.8","v9.1.7-canary.7","v9.1.7-canary.6","v9.1.7-canary.5","v9.1.7-canary.4","v9.1.7-canary.3","v9.1.7-canary.2","v9.1.7-canary.1","v9.1.7-canary.0","v9.1.6","v9.1.6-canary.11","v9.1.6-canary.10","v9.1.6-canary.9","v9.1.6-canary.8","v9.1.6-canary.7","v9.1.6-canary.6","v9.1.6-canary.5","v9.1.6-canary.4","v9.1.6-canary.3","v9.1.6-canary.2","v9.1.6-canary.1","v9.1.6-canary.0","v9.1.5","v9.1.5-canary.17","v9.1.5-canary.16","v9.1.5-canary.15","v9.1.5-canary.14","v9.1.5-canary.13","v9.1.5-canary.12","v9.1.5-canary.11","v9.1.5-canary.10","v9.1.5-canary.9","v9.1.5-canary.8","v9.1.5-canary.7","v9.1.5-canary.6","v9.1.5-canary.5","v9.1.5-canary.4","v9.1.5-canary.3","v9.1.5-canary.2","v9.1.5-canary.1","v9.1.5-canary.0","v9.1.4","v9.1.4-canary.8","v9.1.4-canary.7","v9.1.4-canary.6","v9.1.4-canary.5","v9.1.4-canary.4","v9.1.4-canary.3","v9.1.4-canary.2","v9.1.4-canary.1","v9.1.4-canary.0","v9.1.3","v9.1.3-canary.5","v9.1.3-canary.4","v9.1.3-canary.3","v9.1.3-canary.2","v9.1.3-canary.1","v9.1.3-canary.0","v9.1.2","v9.1.2-canary.10","v9.1.2-canary.9","v9.1.2-canary.8","v9.1.2-canary.7","v9.1.2-canary.6","v9.1.2-canary.5","v9.1.2-canary.4","v9.1.2-canary.3","v9.1.2-canary.2","v9.1.2-canary.1","v9.1.2-canary.0","v9.1.1","v9.1.1-canary.0","v9.1.0","v9.0.9-canary.2","v9.0.9-canary.1","v9.0.9-canary.0","v9.0.8","v9.0.8-canary.5","v9.0.8-canary.4","v9.0.8-canary.3","v9.0.8-canary.2","v9.0.8-canary.1","v9.0.8-canary.0","v9.0.7","v9.0.7-canary.10","v9.0.7-canary.9","v9.0.7-canary.8","v9.0.7-canary.7","v9.0.7-canary.6","v9.0.7-canary.5","v9.0.7-canary.4","v9.0.7-canary.3","v9.0.7-canary.2","v9.0.7-canary.1","v9.0.7-canary.0","v9.0.6","v9.0.6-canary.7","v9.0.6-canary.6","v9.0.6-canary.5","v9.0.6-canary.4","v9.0.6-canary.3","v9.0.6-canary.2","v9.0.6-canary.1","v9.0.6-canary.0","v9.0.5","v9.0.5-canary.3","v9.0.5-canary.2","v9.0.5-canary.1","v9.0.5-canary.0","v9.0.4","v9.0.4-canary.8","v9.0.4-canary.7","v9.0.4-canary.6","v9.0.4-canary.5","v9.0.4-canary.4","v9.0.4-canary.3","v9.0.4-canary.2","v9.0.4-canary.1","v9.0.3","v9.0.3-canary.6","v9.0.3-canary.5","v9.0.3-canary.4","v9.0.3-canary.3","v9.0.3-canary.2","v9.0.3-canary.1","v9.0.3-canary.0","v9.0.2","v9.0.2-canary.1","v9.0.2-canary.0","v9.0.1","v9.0.1-canary.2","v9.0.1-canary.1","v9.0.1-canary.0","v9.0.0","v8.1.1-canary.70","v8.1.1-canary.69","v8.1.1-canary.68","v8.1.1-canary.67","v8.1.1-canary.66","v8.1.1-canary.65","v8.1.1-canary.64","v8.1.1-canary.63","v8.1.1-canary.62","v8.1.1-canary.61","v8.1.1-canary.60","v8.1.1-canary.59","v8.1.1-canary.58","v8.1.1-canary.57","v8.1.1-canary.56","v8.1.1-canary.55","v8.1.1-canary.54","v8.1.1-canary.53","v8.1.1-canary.52","v8.1.1-canary.51","v8.1.1-canary.50","v8.1.1-canary.49","v8.1.1-canary.48","v8.1.1-canary.47","v8.1.1-canary.46","v8.1.1-canary.45","v8.1.1-canary.44","v8.1.1-canary.43","v8.1.1-canary.42","v8.1.1-canary.41","v8.1.1-canary.40","v8.1.1-canary.39","v8.1.1-canary.38","v8.1.1-canary.37","v8.1.1-canary.36","v8.1.1-canary.35","v8.1.1-canary.34","v8.1.1-canary.33","v8.1.1-canary.32","v8.1.1-canary.31","v8.1.1-canary.30","v8.1.1-canary.29","v8.1.1-canary.28","v8.1.1-canary.27","v8.1.1-canary.26","v8.1.1-canary.25","v8.1.1-canary.24","v8.1.1-canary.23","v8.1.1-canary.22","v8.1.1-canary.21","v8.1.1-canary.20","v8.1.1-canary.19","v8.1.1-canary.18","v8.1.1-canary.17","v8.1.1-canary.16","v8.1.1-canary.15","v8.1.1-canary.14","v8.1.1-canary.13","v8.1.1-canary.12","v8.1.1-canary.11","v8.1.1-canary.10","v8.1.1-canary.9","v8.1.1-canary.8","v8.1.1-canary.7","v8.1.1-canary.6","v8.1.1-canary.5","v8.1.1-canary.4","v8.1.1-canary.3","v8.1.1-canary.2","v8.1.1-canary.1","v8.1.1-canary.0","v8.1.0","v8.0.5-canary.35","v8.0.5-canary.34","v8.0.5-canary.33","v8.0.5-canary.32","v8.0.5-canary.31","v8.0.5-canary.30","v8.0.5-canary.29","v8.0.5-canary.28","v8.0.5-canary.27","v8.0.5-canary.26","v8.0.5-canary.25","v8.0.5-canary.24","v8.0.5-canary.23","v8.0.5-canary.22","v8.0.5-canary.21","v8.0.5-canary.20","v8.0.5-canary.19","v8.0.5-canary.18","v8.0.5-canary.17","v8.0.5-canary.16","v8.0.5-canary.15","v8.0.5-canary.14","v8.0.5-canary.13","v8.0.5-canary.12","v8.0.5-canary.11","v8.0.5-canary.10","v8.0.5-canary.9","v8.0.5-canary.8","v8.0.5-canary.7","v8.0.5-canary.6","v8.0.5-canary.5","v8.0.5-canary.4","v8.0.5-canary.3","v8.0.5-canary.2","v8.0.5-canary.1","v8.0.5-canary.0","v8.0.4","v8.0.4-canary.31","v8.0.4-canary.30","v8.0.4-canary.29","v8.0.4-canary.28","v8.0.4-canary.27","v8.0.4-canary.26","v8.0.4-canary.25","v8.0.4-canary.24","v8.0.4-canary.23","v8.0.4-canary.22","v8.0.4-canary.21","v8.0.4-canary.20","v8.0.4-canary.19","v8.0.4-canary.18","v8.0.4-canary.17","v8.0.4-canary.16","v8.0.4-canary.15","v8.0.4-canary.14","v8.0.4-canary.13","v8.0.4-canary.12","v8.0.4-canary.11","v8.0.4-canary.10","v8.0.4-canary.9","v8.0.4-canary.8","v8.0.4-canary.7","v8.0.4-canary.6","v8.0.4-canary.5","v8.0.4-canary.4","v8.0.4-canary.3","v8.0.4-canary.2","v8.0.4-canary.1","v8.0.4-canary.0","v8.0.3","v8.0.3-canary.0","v8.0.2-canary.7","v8.0.2-canary.6","v8.0.2-canary.5","v8.0.2-canary.4","v8.0.2-canary.3","v8.0.2-canary.2","v8.0.2-canary.1","v8.0.2-canary.0","v8.0.1-canary.0","v8.0.0-canary.24","v8.0.0-canary.23","v8.0.0-canary.22","v8.0.0-canary.21","v8.0.0-canary.20","v8.0.0-canary.19","v8.0.0-canary.18","v8.0.0-canary.17","v8.0.0-canary.16","v8.0.0-canary.15","v8.0.0-canary.14","v8.0.0-canary.13","v8.0.0-canary.12","v8.0.0-canary.11","v8.0.0-canary.10","v8.0.0-canary.9","v8.0.0-canary.8","v8.0.0-canary.7","v8.0.0-canary.6","v8.0.0-canary.5","v8.0.0-canary.4","v8.0.0-canary.3","v8.0.0-canary.2","v8.0.0-canary.1","v8.0.0-canary.0","v7.0.2-canary.50","v7.0.2-canary.49","v7.0.2-canary.48","v7.0.2-canary.47","v7.0.2-canary.46","v7.0.2-canary.45","v7.0.2-canary.44","v7.0.2-canary.43","v7.0.2-canary.42","v7.0.2-canary.41","v7.0.2-canary.40","v7.0.2-canary.39","v7.0.2-canary.38","v7.0.2-canary.37","v7.0.2-canary.36","v7.0.2-canary.35","v7.0.2-canary.34","v7.0.2-canary.33","v7.0.2-canary.32","v7.0.2-canary.31","v7.0.2-canary.30","v7.0.2-canary.29","v7.0.2-canary.28","v7.0.2-canary.27","v7.0.2-canary.26","v7.0.2-canary.25","v7.0.2-canary.24","v7.0.2-canary.23","v7.0.2-canary.22","v7.0.2-canary.21","v7.0.2-canary.20","v7.0.2-canary.19","v7.0.2-canary.18","v7.0.2-canary.17","v7.0.2-canary.16","v7.0.2-canary.15","v7.0.2-canary.14","v7.0.2-canary.13","v7.0.2-canary.12","v7.0.2-canary.11","v7.0.2-canary.10","7.0.1","v7.0.2-canary.9","v7.0.2-canary.8","v7.0.2-canary.7","v7.0.2-canary.6","v7.0.2-canary.5","v7.0.2-canary.4","v7.0.2-canary.3","v7.0.2-canary.2","v7.0.2-canary.1","v7.0.2-canary.0","7.0.1-canary.6","7.0.1-canary.5","7.0.1-canary.4","7.0.1-canary.3","7.0.1-canary.2","7.0.1-canary.1","7.0.1-canary.0","7.0.0","6.1.2","6.1.1","6.1.0-canary.0","6.0.4-canary.9","6.0.4-canary.8","6.0.4-canary.7","6.0.4-canary.6","6.0.4-canary.5","6.0.4-canary.4","6.0.4-canary.3","6.0.4-canary.2","6.0.4-canary.1","6.0.4-canary.0","6.0.3-canary.1","6.0.3-canary.0","6.0.2-canary.0","6.0.1-canary.2","6.0.1-canary.1","6.0.1-canary.0","6.0.0-canary.7","6.0.0-canary.6","6.0.0-canary.5","6.0.0-canary.4","6.0.0-canary.3","5.1.0","6.0.0-canary.2","6.0.0-canary.1","5.0.0","3.2.2","4.2.3","4.2.2","4.2.1","4.2.0","4.1.4","4.1.3","4.1.2","4.1.1","4.1.0","4.0.5","4.0.4","4.0.3","4.0.2","4.0.1","4.0.0","4.0.0-beta.6","4.0.0-beta.5","4.0.0-beta.4","4.0.0-beta.3","4.0.0-beta.2","4.0.0-beta.1","3.2.1","3.2.0","3.1.0","3.0.6","3.0.5","3.0.4","3.0.3","3.0.2","3.0.1","2.4.9","2.4.8","2.4.7","2.4.6","2.4.5","2.4.4","2.4.3","v2.4.2","2.4.1","2.4.0","2.3.2","2.3.1","2.3.0","2.2.0","2.1.1","2.1.0","2.0.1","2.0.0","2.0.0-beta.42","2.0.0-beta.41","2.0.0-beta.40","2.0.0-beta.39","2.0.0-beta.38","2.0.0-beta.37","2.0.0-beta.36","2.0.0-beta.35","2.0.0-beta.34","2.0.0-beta.33","2.0.0-beta.32","2.0.0-beta.31","2.0.0-beta.30","2.0.0-beta.29","2.0.0-beta.28","2.0.0-beta.27","2.0.0-beta.26","2.0.0-beta.25","2.0.0-beta.24","2.0.0-beta.23","2.0.0-beta.22","2.0.0-beta.21","2.0.0-beta.20","2.0.0-beta.19","2.0.0-beta.18","2.0.0-beta.17","2.0.0-beta.16","2.0.0-beta.15","2.0.0-beta.14","2.0.0-beta.13","2.0.0-beta.12","2.0.0-beta.11","2.0.0-beta.10","2.0.0-beta.9","2.0.0-beta.8","2.0.0-beta.7","2.0.0-beta.6","2.0.0-beta.5","2.0.0-beta.4","2.0.0-beta.3","2.0.0-beta.2","2.0.0-beta.1","2.0.0-beta.0","1.2.3","1.2.2","1.2.1","1.2.0","1.1.2","1.1.1","1.1.0","1.0.2","1.0.1","1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5284.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}