CVE-2021-38146

HIGH 7.5CVE-2021-38146 · Published 22/11/2021 · updated 17/06/2026

In short

CVE-2021-38146 is a HIGH (CVSS 7.5) vulnerability affecting holmes (wipro).
Chance of exploitation in the next 30 days (EPSS): 11.9%, higher than 96.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
holmes wipro	`= 20.4.1`	No fix yet

Description

The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data.

References

packetstormsecurity.com/files/164970/Wipro-Holmes-Orchestrator-20.4.1-Arbitrary-File-Download.html · Exploit
wipro.com/holmes · Product

More vulnerabilities in holmes

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free