CVE-2026-78602
Received Received - Intake

Path Traversal in Elastic Maps Server

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Elastic

Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-78602
EUVD
EUVD-2026-70055

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
elastic maps_server *
elastic elastic_maps_server From 8.19.11 (inc) to 8.19.18 (inc)
elastic elastic_maps_server From 9.3.0 (inc) to 9.4.3 (inc)
elastic elastic_maps_server to 9.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Path Traversal vulnerability (CWE-22) in Elastic Maps Server. It allows unauthenticated attackers to access files outside the intended directory by exploiting improper pathname restrictions. The server could return contents of readable files due to this flaw.

Detection Guidance

To detect this vulnerability, check if your Elastic Maps Server version is within the affected range (8.19.11 to 8.19.18, 9.3.0 to 9.4.3, or 9.5.0). Use commands like 'curl -v http://<target>/api/console/proxy?path=/etc/passwd' to test for path traversal. Monitor server logs for unusual file access patterns or requests containing '..' or '/etc/'.

Impact Analysis

An attacker could read sensitive files on the server, leading to unauthorized information disclosure. This includes files readable by the server process outside its content directory. No special privileges or user interaction are required.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. It may result in data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade Elastic Maps Server to a patched version (8.19.19, 9.4.4, or 9.5.1) immediately. If upgrading is not possible, restrict network access to the service or disable it until an update is applied. No workarounds exist for unpatched versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart