Directory traversal vulnerability for static file

[leamlidara]

This is my code server.staticFiles('/pf-img/*', 'profile');

and this is my url http://127.0.0.1:1337/pf-img/..%2Fdaplogfile.txt http://127.0.0.1:1337/pf-img/..%2F..%2Fdatabase.sql

both files are existed and accessible on my PC.

[lexia-boris]

You do know that you specify the folder? if you don't want those files accessible remove them from that folder.