Path traversal in the OWASP Enterprise Security APIGHSA-8m5h-hrqm-pxm2
HIGHFix: ESAPI/esapi-java-legacy@a0d67b7GHSA-8m5h-hrqm-pxm2 is a high-severity (CVSS 7.5) Path Traversal vulnerability in org.owasp.esapi:esapi. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for org.owasp.esapi:esapi — see the affected versions and patch details below.
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for GHSA-8m5h-hrqm-pxm2.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
org.owasp.esapi:esapiReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Impact
The default implementation of Validator.getValidDirectoryPath(String, String, File, boolean) may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path.
Patches
This vulnerability is patched in release 2.3.0.0 of ESAPI. See https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.3.0.0 for details.
Workarounds
Yes; in theory, one could write the own implementation of the Validator interface. This would most easily be done by sub-classing a version of the affected DefaultValidator class and then overriding the affected getValidDirectoryPath() to correct the issue. However, this is not recommended.
For more information
If you have any questions or comments about this advisory:
- Email one of the project co-leaders. See email addresses listed on the OWASP ESAPI wiki page, under "Leaders".
- Send email to one of the two ESAPI related Google Groups listed under Where to Find More Information on ESAPI on our README.md page.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.owasp.esapi:esapi | all versions | 2.3.0.0org.owasp.esapi:esapi:2.3.0.0 |
Affected Products
active iq unified managernetapponcommand workflow automationnetappweblogic serveroracleenterprise security apiowaspResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.owasp.esapi:esapi, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.owasp.esapi:esapi to 2.3.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-8m5h-hrqm-pxm2 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
Frequently Asked Questions
Is GHSA-8m5h-hrqm-pxm2 in your dependencies?
Find it across Maven, including transitive dependencies.