Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-78602

Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Elastic Maps Server

Default version status: unaffected

  • 8.19.11 to ≤ 8.19.18affected
  • 9.3.0 to ≤ 9.4.3affected
  • 9.5.0affected

References