CVE-2026-116673— systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net

Quick assessment

Affected

sebhildebrandt systeminformation

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个用于 Node.js 的系统与操作系统信息库。在 5.33.14 版本之前，其 Linux 平台的实现会直接使用调用方提供的接口名称（iface）参数，在未验证该参数是否仅为单一接口名称段、也未确认解析后的路径是否仍位于目录下的前提下，将其用于检查，并构造如的路径（包括文件路径）。若攻击者能够控制该接口名称参数，并在本地文件系统中创建包含符号链接的统计文件目录，则可通过父目录组件和符号链接遍历技术，诱导该 API 返回 Node.js 进程可读文件的第一个内容行。该包本身不暴露任何网络端点，且演示场

CVSS 3.3 · Low Updated Oct 28, 2026

Possible ATT&CK Techniques 3 AI

T1036.006 · Space after Filename T1565.001 · Stored Data Manipulation T1083 · File and Directory Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net

Source: CVE Program / CVE List V5

Vulnerability Description

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
sebhildebrandt	systeminformation	< 5.33.14	-

II. Public POCs for CVE-2026-116673

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116673

请登录查看更多情报信息。

Other References for CVE-2026-116673 (3)

https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.14 x_refsource_MISC
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4vjg-vx72-qq4g x_refsource_CONFIRM
https://github.com/sebhildebrandt/systeminformation/commit/8d294b3139fec654a912969ac898037578a218cd x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116673

IV. Related Vulnerabilities

Same product: systeminformation

Same vendor: sebhildebrandt

Same weakness: CWE-22