Esri ArcGIS Server Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in Esri ArcGIS Server versions 11.3 and prior. This vulnerability may allow a remote, unauthenticated attacker to craft a URL that could disclose sensitive configuration information by reading internal files from the server. The nature of the files that can be accessed through this vulnerability leads to a high impact on confidentiality, with no effects on integrity or availability.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive configuration files, potentially disclosing critical information about the server's setup and operations.

Remediation

Users are advised to update to ArcGIS Server Security 2025 Update 1, which is available through the Esri Support website.