Description
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
Published: 2026-10-22
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Remote File Read
Action: Patch
AI Analysis

Impact

The vulnerability is an unauthenticated path traversal flaw in JeeWMS that allows an attacker to read any file on the underlying file system by providing a crafted dbPath value containing '..' sequences. This enables disclosure of sensitive configuration files or secrets, compromising confidentiality. The weakness is rooted in improper input validation, a classic example of CWE-22.

Affected Systems

The flaw affects all deployed versions of JeeWMS before the commit 0a610e8. The CNA product identification is JeeWMS, and the affected versions are all releases preceding that commit.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity; attackers can exploit the flaw with unauthenticated HTTP GET requests, making the risk significant for publicly exposed servers. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, but it was actively abused in October 2023 as reported by the Shadowserver Foundation, underscoring the real‑world threat of unauthorized file disclosure.

Generated by OpenCVE AI on October 22, 2026 at 12:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update JeeWMS to a version that includes the fix from commit 0a610e8 or apply the patch from the vendor
  • Enable or enforce the AuthInterceptor for the /systemController/showOrDownByurl.do endpoint to prevent unauthenticated access
  • Deploy a web application firewall or proxy rule to block request parameters containing path traversal patterns (e.g., '..') before reaching the application

Generated by OpenCVE AI on October 22, 2026 at 12:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
Title JeeWMS Path Traversal via showOrDownByurl.do
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-22T10:57:30.531Z

Reserved: 2026-10-14T20:25:29.144Z

Link: CVE-2021-48015

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-22T11:17:04.537

Modified: 2026-10-22T11:17:04.537

Link: CVE-2021-48015

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T12:30:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')