Read the docs
TI-2021-22766 Aliases CVE-2021-48015GHSA-86qh-69c7-wj92

Path traversal in JeeWMS lets unauthenticated attackers read files

Priority HIGH 77CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

JeeWMS before commit 0a610e8 contains a path traversal flaw (CWE-22) in which the dbPath parameter is not limited to a restricted directory. A remote attacker without authentication can read arbitrary files, such as win.ini, by sending GET requests with ../ sequences to /systemController/showOrDownByurl.do. The Shadowserver Foundation first observed exploitation on 2023-10-17, and a public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00563 47th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

The sources list no fixed version for JeeWMS.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-10-22 Threatist record created from CVE-2021-48015
  2. 2026-10-22 Alias added: GHSA-86qh-69c7-wj92
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-11-05 CISA SSVC decision points changed
  5. 2026-11-05 Priority changed: LOW → HIGH

References

Exploit 2

Patch 1

Other 1

  • TI-2026-09887 erzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure CVSS 4.0MEDIUM 6.9
  • TI-2026-09886 erzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injection CVSS 4.0MEDIUM 6.9
  • TI-2026-70817 SQL injection in erzhongxmu JEEWMS autocomplete handler CVSS 4.0MEDIUM 5.3
  • TI-2026-70812 SQL injection in erzhongxmu JEEWMS PDA interface CVSS 4.0MEDIUM 5.3
  • TI-2026-70809 SQL injection in erzhongxmu JEEWMS WvGiController list function CVSS 4.0MEDIUM 5.3
  • TI-2026-70808 SQL injection in erzhongxmu JEEWMS search endpoint CVSS 4.0MEDIUM 5.3
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences