Esri ArcGIS Server Path Traversal Vulnerability

A path traversal vulnerability has been identified in Esri ArcGIS Server versions 11.3 and prior. This vulnerability allows remote authenticated attackers with administrative privileges to traverse the file system and access files outside of the designated directory. While there is no impact on integrity or availability due to the nature of the files that can be accessed, this vulnerability poses a significant risk to confidentiality.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files, potentially exposing confidential information.

Remediation

Users are advised to update to ArcGIS Server Security 2025 Update 1, which is available through the Esri Support website. This patch should be applied immediately to all ArcGIS Server machines that are part of an ArcGIS Enterprise Site or Standalone deployment.