Description
OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
Published: 2026-10-22
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated path traversal enables reading of local files such as /etc/passwd.
Action: Patch Immediately
AI Analysis

Impact

The flaw is an unauthenticated path traversal in the style_name parameter of the theme operation. Attackers can craft URLs containing '..' sequences to read arbitrary files, including sensitive system files like /etc/passwd, without needing credentials. This provides direct disclosure of local file contents to an external user.

Affected Systems

OrbiTeam BSCW Server releases 5.x versions before 5.2.5 and 7.x versions before 7.4.4 are affected. The vulnerability is located in the /pub/bscw.cgi handler used by both branches.

Risk and Exploitability

The CVSS score is 8.7, reflecting a high severity level. No EPSS data is available and the issue is not listed in KEV. The attack vector is remote, requiring only that the web service be reachable; no authentication is necessary, making exploitation straightforward and likely if the service is publicly exposed.

Generated by OpenCVE AI on October 22, 2026 at 12:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update OrbiTeam BSCW Server to at least version 5.2.5 or 7.4.4 to apply the vendor fix.
  • If an immediate upgrade is not possible, configure the web server to validate the style_name parameter and reject any value containing '..' or directory separators.
  • Restrict unauthenticated access to the /pub/bscw.cgi endpoint using access controls to limit the ability to read local files.

Generated by OpenCVE AI on October 22, 2026 at 12:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Orbiteam
Orbiteam bscw Server
Vendors & Products Orbiteam
Orbiteam bscw Server

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Description OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
Title OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Orbiteam Bscw Server
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-29T11:16:33.337Z

Reserved: 2026-10-14T20:25:29.144Z

Link: CVE-2021-48017

cve-icon Vulnrichment

Updated: 2026-10-29T11:16:26.039Z

cve-icon NVD

Status : Deferred

Published: 2026-10-22T11:17:04.833

Modified: 2026-10-29T12:17:08.517

Link: CVE-2021-48017

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T14:56:48Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')