CVE-2026-78602

MEDIO 5.3CVE-2026-78602 · Published 02/09/2026 · updated 08/09/2026

In breve

CVE-2026-78602 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda maps server (elastic).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.56%, superiore al 46.4% delle vulnerabilità.
Correzione: aggiornare a 8.19.19, 9.4.4 o successiva.

Package	Affected versions	Patched versions
maps server elastic	`= 9.5.0≥ 8.19.11, < 8.19.19≥ 9.3.0, < 9.4.4`	`8.19.199.4.4`

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.

References

discuss.elastic.co/t/elastic-maps-server-8-19-19-9-4-4-9-5-1-security-update-esa-2026-148/390108 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free