CVE-2020-5284
published 2020-03-30CVE-2020-5284: Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next)…
PriorityP276medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
43.43%
98.6th percentile
Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| next | next | >= 0.9.9 < 9.3.2 | 9.3.2 |
| zeit | next.js | < 9.3.2 | 9.3.2 |
Detection & IOCsextracted from sources · hover to see the quote
yara↗
regex: '\{"/_app":".*?_app\.js"'- →Send a GET request with a path traversal payload targeting the Next.js dist directory. A vulnerable server will respond HTTP 200 with Content-Type: application/json and a body matching the pages-manifest pattern. ↗
- →Match response header for 'application/json' AND response body regex '\{"/_app":".*?_app\.js"' AND HTTP status 200 to confirm exploitation of the directory traversal. ↗
- →Shodan/FOFA fingerprint for exposed Next.js instances: search for 'body="/_next/static"' or 'http.html:"/_next/static"' to identify potentially vulnerable targets. ↗
- ·The traversal only reaches files within the .next (dist) directory. Files outside this directory are not accessible via this vulnerability. ↗
- ·Exploitation requires an authenticated (low-privilege) user per CVSS scoring (PR:L), so unauthenticated mass exploitation may not apply in all deployments. ↗
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck4.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Directory Traversal in Next.js
ghsa·2020-03-30
CVE-2020-5284 [MEDIUM] CWE-23 Directory Traversal in Next.js
Directory Traversal in Next.js
### Impact
- **Not affected**: Deployments on ZEIT Now v2 ([https://zeit.co](https://zeit.co/)) are not affected
- **Not affected**: Deployments using the `serverless` target
- **Not affected**: Deployments using `next export`
- **Affected**: Users of Next.js below 9.3.2
We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
### Patches
https://github.com/zeit/next.js/releases/tag/v9.3.2
### References
https://github.com/zeit/next.js/releases/tag/v9.3.2
OSV
Directory Traversal in Next.js
osv·2020-03-30
CVE-2020-5284 [MEDIUM] Directory Traversal in Next.js
Directory Traversal in Next.js
### Impact
- **Not affected**: Deployments on ZEIT Now v2 ([https://zeit.co](https://zeit.co/)) are not affected
- **Not affected**: Deployments using the `serverless` target
- **Not affected**: Deployments using `next export`
- **Affected**: Users of Next.js below 9.3.2
We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
### Patches
https://github.com/zeit/next.js/releases/tag/v9.3.2
### References
https://github.com/zeit/next.js/releases/tag/v9.3.2
VulnCheck
zeit next.js Relative Path Traversal
vulncheck·2020·CVSS 4.4
CVE-2020-5284 [MEDIUM] zeit next.js Relative Path Traversal
zeit next.js Relative Path Traversal
Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory. This issue is fixed in version 9.3.2.
Affected: zeit next.js
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.labs.greynoise.io/grimoire/2026-03-23-bucklog-k8s/
No detection rules found.
Nuclei
Next.js <9.3.2 - Local File Inclusion
nuclei·CVSS 4.3
CVE-2020-5284 [MEDIUM] Next.js <9.3.2 - Local File Inclusion
Next.js <9.3.2 - Local File Inclusion
Next.js versions before 9.3.2 are vulnerable to local file inclusion. An attacker can craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory only holds build assets unless your application intentionally stores other assets under this directory.
Template:
id: CVE-2020-5284
info:
name: Next.js <9.3.2 - Local File Inclusion
author: rootxharsh,iamnoooob,dwisiswant0
severity: medium
description: Next.js versions before 9.3.2 are vulnerable to local file inclusion. An attacker can craft special requests to access files in the dist directory (.next). This does not affect files outside of the dist directory (.next). In general, the dist directory
2020-03-30
Published
Exploited in the wild