OrbiTeam BSCW Server: unauthenticated path traversal reads local files

1. NVD2026-10-23 21:57 UTC · published 2026-10-22 11:17 UTC · CVE-2021-48017
2. InfraStack analyst2026-10-23 23:43 UTC · published 2026-10-23 23:43 UTC
   “Primary: SEC Consult SA-20211202 (lists this bug as the unauthenticated LFI in op=theme, CVE-2021-44288 there, so 48017 may be a duplicate ID) and the vendor page bscw.de/security-fixes (fixed 5.2.5/7.4.4). CVE record and VulnCheck say Shadowserver observed exploitation (dated 2023-10-22) and cite a Nuclei template and Packet Storm 165156. I found no source saying whether theme is enabled by default; it is a core operation, so assume yes. SEC Consult notes the file content is used as a format string, which limits which files can be read. Not read: NVD page (empty fetch). No social search done.”
3. EPSS2026-10-24 07:15 UTC · CVE-2021-48017

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2021-48017 · 10-23 21:57
• EPSS: CVE-2021-48017 · 10-24 07:15
• SEC Consult: Multiple vulnerabilities in OrbiTeam BSCW ServerAdvisory · InfraStack analyst
• BSCW Security FixesFix · InfraStack analyst
• VulnCheck: BSCW Server path traversalDescribes it · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2021-48017")

NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.