Oliver Library Server v5 - Arbitrary File Download
Priority HIGH 77CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized input in the FileServlet endpoint. Attackers can exploit the vulnerability by manipulating the 'fileName' parameter to download sensitive files from the server's filesystem.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00818 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Oliver Library Server (Softlink Education): 8.00.008.053
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Softlink Education | Oliver Library Server | before 8.00.008.053 | 8.00.008.053 | Patch available | CNA |
- Oliver Library Server VendorSoftlink Education Affected before 8.00.008.053 Fixed in 8.00.008.053 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:softlinkint:oliver_v5_library:*:*:*:*:*:*:*:* | before 8.00.008.053 | Vulnerable | Softlinkint |
- cpe:2.3:a:softlinkint:oliver_v5_library:*:*:*:*:*:*:*:* Versions before 8.00.008.053 Vulnerable ·Softlinkint
Remediation
- Fix · CNA Oliver Library Server (Softlink Education) Fixed in 8.00.008.053
Timeline
- 2026-10-02 Threatist record created from CVE-2021-47755
- 2026-10-03 Alias added: GHSA-c22c-g99c-vw87
References
Exploit 1
More Softlinkint Oliver V5 Library vulnerabilities
- TI-2021-20380 An arbitrary file download vulnerability in Oliver v5 Library Server Versions <… CVSS 3.1HIGH 7.5
Sources
- CVE-2021-47755 · CVE Program
- CVE-2021-47755 · NVD
- FIRST EPSS
- GHSA-c22c-g99c-vw87 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences