NVD HIGH: CVE-2021-48017 — OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthent...

Thursday, October 22, 2026 at 11:17 AM UTC·Source: NIST NVD

Updated: Wednesday, October 28, 2026 at 12:01 AM UTC

Executive Summary

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/ ?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2021-48017

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 22, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Student SSNs and Medicaid IDs Exposed in Frontline School Software Breach

Kalleigh Lane reports: If your school district used Frontline Central or School Health Management, your Social Security number, date of birth, or government ID could have been caught up in a cybersecurity incident. That risk applies to some adults and minors whose information was processed through those products. Frontline Education announced Oct. 26, 2026, that...

50m agoDataBreaches.net

MEDIUMVulnerabilityNEW

GM settles with 36 states for selling driver data, agrees to $220 million fine and reforms

General Motors agreed to pay $220 million to settle a lawsuit filed by a coalition of 36 state attorneys general who alleged the company unlawfully sold information about driver behavior to outside parties.

51m agoThe Record

MEDIUMVulnerability

Fake crypto app on Apple App Store linked to $23K wallet theft

A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. [...]

1h agoBleepingComputer