How do I check whether I am affected by CVE-2021-48013?

Safe read-only test on your own instance: GET /weaver/ln.FileDownload?fpath=../ecology/WEB-INF/web.xml. A 200 response whose body contains /weaver/ means vulnerable (the public nuclei template uses this match). Also check whether /weaver/ is reachable from the internet.

What is the fix for CVE-2021-48013?

No fixed version published by Weaver as of 2026-10-23. Ask Weaver for the latest patch. Until then, block /weaver/ln.FileDownload at the WAF or reverse proxy, remove internet exposure of E-cology, and rotate credentials in WEB-INF/prop/weaver.properties if the endpoint was reachable.

Who is not affected by CVE-2021-48013?

Not affected if: managed-hosting.

Live › vulnerability › CVE-2021-48013

Go to dashboard

high8.7Exploited in the wildOther

Weaver E-cology 8.0: unauthenticated path traversal reads arbitrary server files

Weaver E-cology 8.0 lets anyone without a login read arbitrary files through the fpath parameter of /weaver/ln.FileDownload, for example WEB-INF/web.xml and weaver.properties (database credentials). Exploitation was observed by Shadowserver on 2023-10-18, and public PoCs and nuclei templates exist. No vendor fix or fixed version is published.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.7

high

scored by [email protected]

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: Yes
Public exploit: 1 PoC repo on GitHub
EPSS: 0.7% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, reported in the wild and proof of concept public on GitHub.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads server configuration and other sensitive files without logging in.
CVSS said: 8.7. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2021-48013

Go to dashboard

high8.7Exploited in the wildOther

Weaver E-cology 8.0: unauthenticated path traversal reads arbitrary server files

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.7

high

scored by [email protected]

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: Yes
Public exploit: 1 PoC repo on GitHub
EPSS: 0.7% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, reported in the wild and proof of concept public on GitHub.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads server configuration and other sensitive files without logging in.
CVSS said: 8.7. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Weaver E-cology 8.0: unauthenticated path traversal reads arbitrary server files

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Weaver E-cology 8.0: unauthenticated path traversal reads arbitrary server files

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources