8.7-High Unauthenticated Path Traversal Hits OrbiTeam BSCW Server

Organizations running older versions of OrbiTeam BSCW Server face immediate exposure to unauthenticated data theft. The National Vulnerability Database records CVE-2021-48017 as a high-severity path traversal flaw. This issue allows attackers to read sensitive local files without needing valid user credentials. The vulnerability stems from improper handling of input in the theme operation feature.

What exactly is vulnerable?

The flaw exists in the `style_name` parameter within the theme operation of OrbiTeam BSCW Server. It affects version 5.x prior to 5.2.5 and version 7.x prior to 7.4.4. The weakness is classified as CWE-22, indicating a canonical path traversal issue. Attackers exploit this by sending specific GET requests to the `/pub/bscw.cgi/<id>?op=theme` endpoint. They inject directory traversal sequences such as `../` into the `style_name` argument to escape the intended directory structure.

How serious is the threat?

The National Vulnerability Database assigns a CVSS score of 8.7, marking the severity as high. This rating reflects the ease of exploitation and the lack of authentication required. Attackers can access arbitrary local files on the server. Common targets include system configuration files like `/etc/passwd`. As Firewall Scoop reported on 2026-10-13, similar unauthenticated path traversal flaws in other infrastructure software can lead to arbitrary file writes and remote code execution. While this specific flaw allows file reading, the access to sensitive data remains a critical risk.

Is this being exploited in the wild?

Yes, exploitation evidence has been observed. The Shadowserver Foundation first detected active exploitation of this vulnerability on October 22, 2023. This confirms that automated scanners or targeted attackers are actively probing for exposed instances. The presence of wild exploitation means that any internet-facing server running the affected versions is likely under constant scrutiny. Defenders should assume their environments are being tested for this specific endpoint pattern.

What is the current status?

The source material identifies the affected versions and the nature of the flaw. It specifies that versions before 5.2.5 and 7.4.4 contain the vulnerability. This implies that versions 5.2.5 and 7.4.4 do not contain the flaw. Organizations must verify their current version against these thresholds. If an organization runs an older version, it is exposed. The material does not provide further details on patch availability or vendor statements beyond the version numbers.

Detection notes

Security operations teams should monitor web server logs for GET requests targeting the `/pub/bscw.cgi` endpoint. Look specifically for the `op=theme` parameter combined with `style_name` arguments containing multiple `../` sequences. These patterns indicate path traversal attempts. Alert on any successful responses to these malformed requests, especially if they return unexpected file contents. Check for access to sensitive system files like `/etc/passwd`. Isolate affected servers immediately if exploitation is confirmed. Review firewall rules to block external access to this specific CGI path until patches are applied.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: OrbiTeam

• Inventory all OrbiTeam BSCW Server installations to identify versions 5.x before 5.2.5 and 7.x before 7.4.4.
• Monitor web server access logs for GET requests to `/pub/bscw.cgi` containing `op=theme` and directory traversal sequences.
• Restrict network access to the BSCW Server endpoints from untrusted networks until verified updates are applied.
• Verify that the `style_name` parameter is not accessible without authentication in your current configuration.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific versions of OrbiTeam BSCW Server are affected by CVE-2021-48017?

Versions 5.x before 5.2.5 and 7.x before 7.4.4 are affected by this unauthenticated path traversal vulnerability.

Can attackers exploit this flaw without logging in?

Yes, the vulnerability is unauthenticated, meaning attackers do not need valid user credentials to exploit it.

What was the first date that exploitation was observed?

The Shadowserver Foundation first observed exploitation evidence for this vulnerability on October 22, 2023.