Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure (Elastic Elastic Maps Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.56 % · percentile 46 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- elastic
- NVD status
- Analyzed
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.
Weaknesses (CWE)
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | elastic |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · security@elastic.co (Secondary) |
European references
- ENISA EUVD · EUVD-2026-70055
- GCVE · GCVE-0-2026-78602
CERT-FR advisories
- CERTFR-2026-AVI-1107 — Multiples vulnérabilités dans les produits Elastic · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:elastic:maps_server:*:*:*:*:*:*:*:*≥ 8.19.11 < 8.19.19cpe:2.3:a:elastic:maps_server:*:*:*:*:*:*:*:*≥ 9.3.0 < 9.4.4cpe:2.3:a:elastic:maps_server:9.5.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Elastic · Elastic Maps Server | affected 8.19.11 ≤ 8.19.18 ; affected 9.3.0 ≤ 9.4.3 ; affected 9.5.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |