Description
OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
Published: 2026-10-22
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Unauthenticated path traversal enables reading of local files such as /etc/passwd.
Action: Patch Immediately
AI Analysis

Impact

The flaw is an unauthenticated path traversal in the style_name parameter of the theme operation. Attackers can craft URLs containing '..' sequences to read arbitrary files, including sensitive system files like /etc/passwd, without needing credentials. This provides direct disclosure of local file contents to an external user.

Affected Systems

OrbiTeam BSCW Server releases 5.x versions before 5.2.5 and 7.x versions before 7.4.4 are affected. The vulnerability is located in the /pub/bscw.cgi handler used by both branches.

Risk and Exploitability

The CVSS score is 8.7, reflecting a high severity level. No EPSS data is available and the issue is not listed in KEV. The attack vector is remote, requiring only that the web service be reachable; no authentication is necessary, making exploitation straightforward and likely if the service is publicly exposed.

Generated by OpenCVE AI on October 22, 2026 at 12:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update OrbiTeam BSCW Server to at least version 5.2.5 or 7.4.4 to apply the vendor fix.
  • If an immediate upgrade is not possible, configure the web server to validate the style_name parameter and reject any value containing '..' or directory separators.
  • Restrict unauthenticated access to the /pub/bscw.cgi endpoint using access controls to limit the ability to read local files.

Generated by OpenCVE AI on October 22, 2026 at 12:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
Title OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-22T10:57:31.855Z

Reserved: 2026-10-14T20:25:29.144Z

Link: CVE-2021-48017

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-22T11:17:04.833

Modified: 2026-10-22T11:17:04.833

Link: CVE-2021-48017

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T12:30:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')