Description
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
Published: 2026-10-22
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote File Read
Action: Patch
AI Analysis

Impact

The vulnerability is an unauthenticated path traversal flaw in JeeWMS that allows an attacker to read any file on the underlying file system by providing a crafted dbPath value containing '..' sequences. This enables disclosure of sensitive configuration files or secrets, compromising confidentiality. The weakness is rooted in improper input validation, a classic example of CWE-22.

Affected Systems

The flaw affects all deployed versions of JeeWMS before the commit 0a610e8. The CNA product identification is JeeWMS, and the affected versions are all releases preceding that commit.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity; attackers can exploit the flaw with unauthenticated HTTP GET requests, making the risk significant for publicly exposed servers. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, but it was actively abused in October 2023 as reported by the Shadowserver Foundation, underscoring the real‑world threat of unauthorized file disclosure.

Generated by OpenCVE AI on October 22, 2026 at 12:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update JeeWMS to a version that includes the fix from commit 0a610e8 or apply the patch from the vendor
  • Enable or enforce the AuthInterceptor for the /systemController/showOrDownByurl.do endpoint to prevent unauthenticated access
  • Deploy a web application firewall or proxy rule to block request parameters containing path traversal patterns (e.g., '..') before reaching the application

Generated by OpenCVE AI on October 22, 2026 at 12:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Erzhongxmu
Erzhongxmu jeewms
Vendors & Products Erzhongxmu
Erzhongxmu jeewms

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
Title JeeWMS Path Traversal via showOrDownByurl.do
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Erzhongxmu Jeewms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-05T15:59:12.806Z

Reserved: 2026-10-14T20:25:29.144Z

Link: CVE-2021-48015

cve-icon Vulnrichment

Updated: 2026-11-05T15:59:09.351Z

cve-icon NVD

Status : Deferred

Published: 2026-10-22T11:17:04.537

Modified: 2026-11-05T16:17:05.237

Link: CVE-2021-48015

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T15:15:07Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')