High 7.5Published Oct 22, 2026

CVE-2021-48015JeeWMS Path Traversal via showOrDownByurl.do

Updated under an hour ago (Oct 27, 2026, 3:40 AM ET)

Does this affect you?

It affects erzhongxmu JeeWMS. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.56%, higher than 47% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for erzhongxmu JeeWMS

Exploited in the last 30 days

JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.56% (percentile 47)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 22, 2026
First seen by InfoSec Signals: Oct 22, 2026

Affected products

Affected products

erzhongxmu JeeWMS erzhongxmu:jeewms (from the name)	194f221776cfcfd838abab7107b1a8352ea2bc59 builds before 0a610e8178a0a1197e9c6615b58faf67c406d2bc	CNA record

References

References

https://github.com/MrWQ/vulnerability-paper/blob/master/bugs/JEEWMS_%E4%BB%93%E5%BA%93%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E5%AD%98%E5%9C%A8%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87%E6%BC%8F%E6%B4%9E%E5%92%8C%E6%9C%AA%E6%8E%88%E6%9D%83%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96.md	technical-description, exploit
https://github.com/tzwlhack/Vulnerability/blob/main/JEEWMS%20%E6%9C%AA%E6%8E%88%E6%9D%83%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md	exploit
https://github.com/erzhongxmu/JeeWMS/commit/0a610e8178a0a1197e9c6615b58faf67c406d2bc	patch
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/jeewms-lfi.yaml	technical-description
https://www.vulncheck.com/advisories/jeewms-path-traversal-via-showordownbyurl-do	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.