EUVD-2026-41897
GHSA-8h42-h5vq-h5gv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote traversal over HTTP (AV:N/AC:L/PR:N/UI:N) yields high file-disclosure confidentiality impact with no integrity or availability effect (C:H/I:N/A:N).
Primary rating from Vendor (Esri).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow access to sensitive files on the system. This issue impacts all versions of ArcGIS Server 12.0 and prior.
AnalysisAI
Unauthenticated file disclosure in Esri ArcGIS Server (all versions 12.0 and prior) lets remote attackers read sensitive files by supplying crafted path parameters that escape the intended directory. The flaw is network-reachable with no authentication or user interaction and, per CISA's SSVC framework, is automatable with total technical impact, though no public exploit has been identified and EPSS exploitation probability remains modest at 0.72%. Esri disclosed and patched the issue in its May 2026 ArcGIS security bulletin.
Technical ContextAI
ArcGIS Server is Esri's core geospatial back-end that publishes GIS maps, imagery, and analytics services over HTTP/REST, typically as part of an ArcGIS Enterprise deployment. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): request handling accepts attacker-controlled path parameters without adequately canonicalizing or constraining them, so sequences such as '../' can traverse outside the intended web/service directory and resolve to arbitrary files on the host. The affected component is identified in CPE data as cpe:2.3:a:esri:arcgis_server, spanning all release trains up to and including 12.0.
RemediationAI
Apply the fixed release identified in Esri's May 2026 ArcGIS security bulletin (https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/may-2026-arcgis-security-bulletin); because the input does not state an exact patched build number, treat the bulletin as the source of the specific version and upgrade all ArcGIS Server instances beyond 12.0 to that patched release rather than relying on an invented version. Until patched, place ArcGIS Server behind a reverse proxy or WAF that normalizes and rejects path-traversal sequences ('../', encoded '%2e%2e%2f', null-byte and double-encoding variants) on service request paths, and restrict network exposure of the Server REST/admin endpoints to trusted networks or VPN - note this reduces reach for legitimate remote GIS clients and federated Portal components, so validate federation still functions. Enforce least-privilege on the OS account running ArcGIS Server so that any traversal reads expose as few sensitive files as possible, and monitor web logs for suspicious traversal patterns.
More in Arcgis Server
View allSQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via
A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthe
Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations. Rated critical severity (CVSS 9.8), this vu
A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote,
A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that cou
There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under uni
Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service
SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL comm
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated a
There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Rated high severity (CVSS 7.5),
Unrestricted file upload in Esri ArcGIS Server (all versions through 12.0) lets a remote, unauthenticated attacker push
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and e
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today