Description
Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files such as WEB-INF/web.xml from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Weaver Network | E-cology | 8.0 | — |
References
- PeiQi Wiki GitHub Exploit technical-description exploit
- Nuclei Template technical-description
- VulnCheck Advisory: Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload third-party-advisory