CVE-2026-78602: Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any deployment where Elastic Maps Server is reachable over the network is exposed to unauthenticated exploitation. The impact is limited to files outside the intended content directory that the server process is permitted to read.
What access does an attacker need?
An attacker needs only network reachability to the Elastic Maps Server service. No authentication, privileges, or user interaction are required.
What is the expected impact if exploitation succeeds?
Successful exploitation can disclose readable files from outside the server's intended content directory. The provided severity vector indicates confidentiality impact only; no integrity or availability impact is stated.