Esri ArcGIS Server Path Traversal Vulnerability

A path traversal vulnerability has been identified in Esri ArcGIS Server versions 11.3 and prior. This vulnerability allows remote authenticated attackers with admin privileges to traverse the file system and access files outside of the intended directory. While there is no impact on integrity or availability, the vulnerability poses a significant risk to confidentiality.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files, potentially exposing confidential information.

Remediation

Esri has released a security patch for this vulnerability as part of the ArcGIS Server Security 2025 Update 1 Patch. This patch should be applied immediately to all ArcGIS Server machines, whether on Windows or Linux, that are part of an ArcGIS Enterprise Site or Standalone deployment. The patch is available through the Esri Support website.