{"id":"CVE-2021-48017","kind":"vulnerability","aliases":["CVE-2021-48017"],"related":[],"title":"OrbiTeam BSCW Server: unauthenticated path traversal reads local files","description":"OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.","summary":"BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 allow unauthenticated file reads through ../ in the style_name parameter of /pub/bscw.cgi/?op=theme. The Shadowserver Foundation has seen exploitation, and a public Nuclei template and Packet Storm entry exist. SEC Consult reported it in 2021. Upgrade to 5.2.5 or 7.4.4.","severity":"high","cvss":8.7,"epss":0.00428,"exploited":true,"exploited_at":null,"products":[{"name":"BSCW Server","fixed":["5.2.5","7.4.4"],"affected":">= 5.0.0, < 5.2.5; >= 7.0.0, < 7.4.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bscw","orbiteam","package","path-traversal","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"Check the BSCW Server version in the admin/about page; anything in 5.0–5.2.4 or 7.0–7.4.3 is affected. Test with a GET to /pub/bscw.cgi/?op=theme using ../ in style_name (a public Nuclei template exists). Check web logs for op=theme requests with ../ in style_name.","fix":"Upgrade to BSCW 5.2.5 (build 5.2.5-60ee02e) or 7.4.4 (build 7.4.4-e053d93). The vendor lists no workaround.","status":"open","published_at":"2026-10-22T11:17:04+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:35:19+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:35:19Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade BSCW Server 5.x to 5.2.5 or later, or 7.x to 7.4.4 or later.","reach":"internet","title":"OrbiTeam BSCW Server: unauthenticated path traversal reads local files","impact":"medium","summary":"BSCW Server versions 5.x before 5.2.5 and 7.x before 7.4.4 let anyone send a GET request with ../ sequences in the style_name theme parameter. An attacker can read local files such as /etc/passwd without logging in.","category":"package","who_cares":["bscw","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads arbitrary server files, including credentials and config.","analyst_note":"Confirm the exact fixed versions and whether the theme operation is enabled by default; check the NVD entry and vendor advisory for a detection path.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000488,"input_tokens":2990,"output_tokens":378,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exact fixed versions and whether the theme operation is enabled by default; check the NVD entry and vendor advisory for a detection path.","search":"'-10':138C '-2021':11A,14A '-22':139C '-48017':12A,15A '/etc/passwd':126C '/pub/bscw.cgi':49B,112C '2021':73B '2023':137C '5':29B,82C '5.2.5':32B,76B,85C '7':34B,87C '7.4.4':37B,78B,90C 'allow':38B 'attack':106C 'bscw':2A,16A,18B,27B,80C 'consult':69B 'contain':91C 'cve':10A,13A 'entri':66B 'evid':128C 'exist':67B 'exploit':57B,127C 'file':9A,40B,123C 'first':130C 'foundat':54B,135C 'get':109C 'host':26B 'local':8A,122C 'name':46B,100C,119C 'nuclei':61B 'observ':131C 'op':50B,113C 'oper':105C 'orbiteam':1A,19B,79C 'packag':20B 'packet':64B 'paramet':47B,101C 'path':5A,22B,94C 'path-travers':21B 'public':60B 'read':7A,41B,121C 'report':70B 'request':110C 'sec':68B 'seen':56B 'self':25B 'self-host':24B 'send':108C 'sequenc':116C 'server':3A,17A,28B,81C 'shadowserv':53B,134C 'storm':65B 'style':45B,99C,118C 'templat':62B 'theme':51B,104C,114C 'travers':6A,23B,95C 'unauthent':4A,39B,93C 'upgrad':74B 'vulner':96C 'x':30B,35B,83C,88C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2021-48017","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48017","severity":null,"published_at":"2026-10-22T11:17:04+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2021-48017:503","url":null,"severity":null,"published_at":"2026-10-23T23:43:04+00:00","modified_at":"2026-10-23T23:43:04+00:00","first_seen_at":"2026-10-23T23:43:04+00:00","fetched_at":"2026-10-23T23:43:04+00:00","note":"Primary: SEC Consult SA-20211202 (lists this bug as the unauthenticated LFI in op=theme, CVE-2021-44288 there, so 48017 may be a duplicate ID) and the vendor page bscw.de/security-fixes (fixed 5.2.5/7.4.4). CVE record and VulnCheck say Shadowserver observed exploitation (dated 2023-10-22) and cite a Nuclei template and Packet Storm 165156. I found no source saying whether theme is enabled by default; it is a core operation, so assume yes. SEC Consult notes the file content is used as a format string, which limits which files can be read. Not read: NVD page (empty fetch). No social search done."},{"source":"epss","external_id":"CVE-2021-48017","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48017","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":2129,"url":"https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-bscw-server/","title":"SEC Consult: Multiple vulnerabilities in OrbiTeam BSCW Server","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2130,"url":"https://www.bscw.de/security-fixes/","title":"BSCW Security Fixes","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2131,"url":"https://www.vulncheck.com/advisories/orbiteam-bscw-server-5.2.5-7.4.4-path-traversal-via-bscw-cgi","title":"VulnCheck: BSCW Server path traversal","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}