---
id: "CVE-2021-48015"
kind: "vulnerability"
aliases: ["CVE-2021-48015"]
title: "JeeWMS: unauthenticated path traversal lets attackers read arbitrary server files"
severity: "high"
cvss: 8.7
epss: 0.00563
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["java", "jeewms", "other"]
not_affected_if: ["commit-0a610e8-or-later", "jeewms-not-deployed"]
published_at: "2026-10-22T11:17:04+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-48015", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-48015", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# JeeWMS: unauthenticated path traversal lets attackers read arbitrary server files

JeeWMS before commit 0a610e8 has a path traversal flaw in the dbPath parameter of a GET endpoint, and it skips the login check. A remote attacker can send ../ sequences to read any file the application can access, such as win.ini.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Search web server logs for GET requests to /systemController/showOrDownByurl.do that contain ../ in dbPath.
Confirm the deployed JeeWMS commit is at or after 0a610e8.

## Fix

Update JeeWMS to commit 0a610e8 or later; the sources do not name a release.
Until then, block or restrict access to /systemController/showOrDownByurl.do.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-48015
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-48015

## From the sources

JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_