CVE-2021-48015

High

Description

JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.

SeverityHigh

CVSS7.5

Exploit probability—

ProductJeeWMS

PublishedOct 22, 2026

First seenOct 22, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

erzhongxmu JeeWMS0a610e8178a0a1197e9c6615b58faf67c406d2bc or later

Patches

github.com/erzhongxmu/JeeWMS/commit/0a610e8178a0a1197e9c6615b58faf67c406d2bc

Affected products

Product	Affected versions	Fixed in
erzhongxmu JeeWMS	194f221776cfcfd838abab7107b1a8352ea2bc59 ≤ v < 0a610e8178a0a1197e9c6615b58faf67c406d2bc	0a610e8178a0a1197e9c6615b58faf67c406d2bc

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.