Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine…
Priority HIGH 74CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name, then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072.
Why it matters now
EPSS 0.84182 99th percentileScored 2026-11-07
Public exploit Yes 7 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-6037
- 2026-10-03 Alias added: GHSA-48g9-8f3w-6mc2
References
Exploit 7
- http://packetstormsecurity.com/files/128102/ManageEngine-EventLog-Analyzer-9.9-Authorization-Code-Execution.html
- 34519
- 20140831 Mogwai Security Advisory MSA-2014-01: ManageEngine EventLog Analyzer Multiple Vulnerabilities
- https://github.com/rapid7/metasploit-framework/pull/3732
- 20140903 Re: Mogwai Security Advisory MSA-2014-01: ManageEngine EventLog Analyzer Multiple Vulnerabilities
- 20140903 Re: Mogwai Security Advisory MSA-2014-01: ManageEngine EventLog Analyzer Multiple Vulnerabilities
- https://www.mogwaisecurity.de/advisories/MSA-2014-01.txt
More Zohocorp Manageengine Eventlog Analyzer vulnerabilities
- TI-2015-06140 ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers… CVSS 2.0HIGH 7.5
- TI-2014-04986 Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database… CVSS 3.1HIGH 7.5
- TI-2014-04987 ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials… CVSS 3.1HIGH 7.5
- TI-2021-09884 Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated… CVSS 3.1CRITICAL 9.8
- TI-2020-15194 An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number… CVSS 3.1CRITICAL 9.8
- TI-2019-14250 An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build… CVSS 3.1HIGH 8.8
Sources
- CVE-2014-6037 · CVE Program
- CVE-2014-6037 · NVD
- FIRST EPSS
- GHSA-48g9-8f3w-6mc2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences