EUVD-2026-70055
GHSA-3435-h7j6-qq7r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable unauthenticated path traversal with read-only impact bounded to server-process-readable files; no integrity or availability impact applies.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
1DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.
AnalysisAI
Path traversal in Elastic Maps Server exposes arbitrary files readable by the server process to unauthenticated network attackers. Insufficient path restriction in the content-directory serving logic allows crafted requests to escape the intended directory using traversal sequences, returning sensitive file contents. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration is required - any default deployment of Elastic Maps Server prior to version 8.19.19 / 9.4.4 / 9.5.1 that is network-reachable is vulnerable without authentication (PR:N, UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 score accurately reflects the moderate severity: the attack requires no authentication, no user interaction, and is network-accessible (AV:N/AC:L/PR:N/UI:N), but the impact ceiling is low - disclosure is bounded by what the server process OS user can read, and S:U confirms no scope change or lateral system compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Elastic Maps Server 8.19.19, 9.4.4, or 9.5.1 per Elastic advisory ESA-2026-148 (https://discuss.elastic.co/t/elastic-maps-server-8-19-19-9-4-4-9-5-1-security-update-esa-2026-148/390108). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today