---
id: "CVE-2021-48017"
kind: "vulnerability"
aliases: ["CVE-2021-48017"]
title: "OrbiTeam BSCW Server: unauthenticated path traversal reads local files"
severity: "high"
cvss: 8.7
epss: 0.00428
exploited: true
status: "open"
category: "package"
products: [{"name": "BSCW Server", "fixed": ["5.2.5", "7.4.4"], "affected": ">= 5.0.0, < 5.2.5; >= 7.0.0, < 7.4.4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["bscw", "orbiteam", "package", "path-traversal", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-10-22T11:17:04+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-48017", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:43:04+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-48017", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# OrbiTeam BSCW Server: unauthenticated path traversal reads local files

BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 allow unauthenticated file reads through ../ in the style_name parameter of /pub/bscw.cgi/?op=theme. The Shadowserver Foundation has seen exploitation, and a public Nuclei template and Packet Storm entry exist. SEC Consult reported it in 2021. Upgrade to 5.2.5 or 7.4.4.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BSCW Server affected >= 5.0.0, < 5.2.5; >= 7.0.0, < 7.4.4 fixed 5.2.5, 7.4.4

## How to check

Check the BSCW Server version in the admin/about page; anything in 5.0–5.2.4 or 7.0–7.4.3 is affected. Test with a GET to /pub/bscw.cgi/?op=theme using ../ in style_name (a public Nuclei template exists). Check web logs for op=theme requests with ../ in style_name.

## Fix

Upgrade to BSCW 5.2.5 (build 5.2.5-60ee02e) or 7.4.4 (build 7.4.4-e053d93). The vendor lists no workaround.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-48017
- 2026-10-23T23:43:04+00:00 analyst — Primary: SEC Consult SA-20211202 (lists this bug as the unauthenticated LFI in op=theme, CVE-2021-44288 there, so 48017 may be a duplicate ID) and the vendor page bscw.de/security-fixes (fixed 5.2.5/7.4.4). CVE record and VulnCheck say Shadowserver observed exploitation (dated 2023-10-22) and cite a Nuclei template and Packet Storm 165156. I found no source saying whether theme is enabled by default; it is a core operation, so assume yes. SEC Consult notes the file content is used as a format string, which limits which files can be read. Not read: NVD page (empty fetch). No social search done.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-48017

## Documents

- [advisory] SEC Consult: Multiple vulnerabilities in OrbiTeam BSCW Server https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-bscw-server/
- [describes] VulnCheck: BSCW Server path traversal https://www.vulncheck.com/advisories/orbiteam-bscw-server-5.2.5-7.4.4-path-traversal-via-bscw-cgi
- [fix] BSCW Security Fixes https://www.bscw.de/security-fixes/

## From the sources

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_