Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T15:17:41.420Z",
  "pubdate": "2026-09-02T15:17:41.420Z",
  "executiveSummary": "This vulnerability involves an Improper Limitation of a Pathname to a Restricted Directory (CWE-22) within the Elastic Maps Server.\nThe flaw allows unauthenticated remote attackers to perform path traversal (CAPEC-126) to access arbitrary files on the underlying filesystem.\nBy manipulating input parameters to request resources outside of the intended web root or data directory, an attacker can exfiltrate sensitive files readable by the server process.\nThe risk is categorized as high, as the vulnerability is reachable over the network without requiring prior authentication or user interaction.\nSuccessful exploitation results in unauthorized information disclosure, potentially exposing configuration files, credentials, or sensitive system data stored on the host server.\nImpact includes the compromise of confidentiality and potential escalation of attack chains depending on the content retrieved from the host filesystem.",
  "technicalDetails": "The root cause of this vulnerability is insufficient input validation and sanitization of user-supplied paths before they are used in file system operations within the Elastic Maps Server.\nSpecifically, the application fails to properly implement path normalization or check for directory traversal sequences, such as '../', which allow an attacker to escape the designated content directory.\nThe attack flow begins when an attacker identifies the endpoint responsible for serving map-related assets or metadata. By injecting directory traversal payloads into a request parameter that influences a file path, the attacker forces the server process to resolve the path to a location outside the restricted directory.\nBecause the server process executes with specific system privileges, it attempts to access the requested file. If the file is readable by the user account running the Elastic Maps Server, the server includes the file content in the HTTP response, effectively bypassing intended access controls.\nThe vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and maps to CAPEC-126 (Path Traversal).\nExploitation does not require authentication; the attacker only needs network reachability to the Elastic Maps Server instance. No specific privilege level is required on the server, as the vulnerability is inherent to the application's request processing logic.\nThe payload behavior involves the transmission of specially crafted HTTP requests containing traversal sequences. Upon successful resolution, the server leaks arbitrary files. Post-exploitation impact varies based on the sensitivity of the files accessible via the server process, but generally includes unauthorized access to system configuration files, environmental variables, or other sensitive data residing on the same partition or accessible via the mounted filesystem.\nThe lack of adequate path constraint mechanisms allows for the circumvention of security boundaries, permitting a 'jailbreak' of the service's file access scope."
}