CVE-2018-18809

KEVTIBCO JasperReports Library Directory Traversal Vulnerability

Description

TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

PublishedMar 7, 2019

Last modifiedJun 17, 2026

Added to KEVDec 29, 2022

Remediation dueJan 19, 2023

References

packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.htmlThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2019/Sep/17Mailing ListThird Party Advisory
securityfocus.com/bid/107351Broken LinkThird Party Advisory
tibco.com/services/support/advisoriesVendor Advisory
cybersecurityworks.com/zerodays/cve-2018-18809-tibco.htmlExploitThird Party Advisory
security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.htmlExploitThird Party Advisory
tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-18809US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1377 days
CVSS: 6.5 MEDIUM
EPSS (30-day exploit probability): 79.1% · top 1% of all CVEs
Weakness: CWE-22
Attack vector: Network, remotely reachable

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.