{"id":"CVE-2015-8859","title":"The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.","summary":"The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendor":"send_project","product":"send","affected":["send < 0.11.1"],"patched":["send 0.11.1"],"published":"2017-01-23","updated":"2026-10-08","sourceUpdated":"2026-10-08T21:17:04.487","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2015-8859","references":[{"url":"http://www.openwall.com/lists/oss-security/2016/04/20/11","label":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/96435","label":"cve@mitre.org"},{"url":"https://nodesecurity.io/advisories/56","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2016/04/20/11","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/96435","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://nodesecurity.io/advisories/56","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.04702,"epssPercentile":0.91759,"ingestedAt":"2026-10-08T22:11:53.691Z","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-08T20:54:13.538212Z"},"slug":"CVE-2015-8859","body":"## Overview\n\nThe send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.\n\n## Affected\n\n- `send < 0.11.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `send 0.11.1`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.2,"likelihood":0.9,"exploitation":0,"ransomware":0},"changes":[]}