---
id: "CVE-2026-116673"
kind: "vulnerability"
aliases: ["CVE-2026-116673"]
title: "systeminformation: path traversal in networkStats reads first line of local files"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["linux", "node.js", "package", "systeminformation"]
not_affected_if: ["fixed-interface-names", "no-networkstats-use", "non-linux"]
published_at: "2026-10-27T17:16:59+00:00"
first_seen_at: "2026-10-27T17:32:46+00:00"
updated_at: "2026-10-27T17:35:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116673", "first_seen_at": "2026-10-27T17:32:46+00:00"}]
---

# systeminformation: path traversal in networkStats reads first line of local files

The systeminformation Node.js library's Linux networkStats(iface) function builds /sys/class/net paths from a caller-supplied interface name without checking it. An attacker who controls that input and can place symlinked files on disk can make the API return the first line of any file the Node.js process can read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `npm ls systeminformation` in each project to find installed versions below `5.33.14`.
- Check whether the application passes user-controlled values into `networkStats(iface)`.

## Fix

- Upgrade the `systeminformation` package to `5.33.14` or later.
- Validate interface names to a single path segment before calling `networkStats` if you pass external input.

## Timeline

- 2026-10-27T17:32:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116673

## From the sources

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_