Advisoriesby IbisElasticCVE-2026-78602
Elastic Maps Server: path traversal
No fix yet
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Elastic Maps Server Product | >= 8.19.11, <= 8.19.18 | No fix yet |
| >= 9.3.0, <= 9.4.3 | No fix yet | |
| <= 9.5.0 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-22