CVE-2025-59342 PoC — esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header

Title:esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header (CVE-2025-59342)
Description:esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Version 136.1 contains a patch.

esm.sh <= 136 contains a path traversal caused by improper canonicalization of the X-Zone-Id HTTP header, letting attackers write files outside the intended storage directory, exploit requires crafted header input.

 id: CVE-2025-59342

info:
  name: esm.sh <= v136 - Arbitrary File Write via Path Traversal
  author:

...