Weaver E-cology 8.0: Unauthenticated path traversal via ln.FileDownload
Summary
Weaver E-cology 8.0 contains a path traversal vulnerability in the fpath parameter of the /weaver/ln.FileDownload endpoint. An unauthenticated remote attacker can send crafted GET requests to read arbitrary files, such as WEB-INF/web.xml, from the server. Exploitation evidence was first reported by the Shadowserver Foundation on 2023-10-18, and the CVE record and public sources conflict on whether public exploit code exists.
Affected
- Weaver Network Co., Ltd. E-cology 8.0 (per CVE record; other versions not confirmed)
Fixed in
- Unknown. No vendor fix or advisory was found.
Workaround
- Restrict access to the E-cology application at the perimeter (firewall or WAF), or allow only VPN or known IP addresses.
- Review web server and application logs for requests to the affected endpoint path (detection only, not a fix).
Exploitation
- Unauthenticated, network-reachable.
- Shadowserver Foundation observed exploitation first on 2023-10-18.
- CISA SSVC lists exploitation as PoC and automatable: yes.
- KEV listing: unconfirmed.
- Public detection template and write-up exist; sources conflict on public exploit availability.
Our recommendation
- Verify whether any E-cology 8.0 instance is reachable from the internet and remove that exposure immediately.
- Confirm the exact version in use and check Weaver's security pages or local partner for a supported, fixed release.
- Review logs for requests to /weaver/ln.FileDownload with directory traversal sequences.
- Plan an upgrade to a supported E-cology release; a separate, more severe Weaver E-cology 10.0 issue (CVE-2026-22679) also requires patching if you run that version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- ProjectDiscovery nuclei template github.com
- PeiQi-WIKI-Book write-up github.com
- VulDB entry 425265 vuldb.com
- Strix CVE record www.strix.ai
- HOL Guard CVE record hol.org
- Vulners RAPID7 entry vulners.com
- CVE-2026-22679 PoC repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:50.
Original description (NVD)
Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files such as WEB-INF/web.xml from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
NVD references (3)
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20…
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/weaver/ecology/ecology-fi…
- https://www.vulncheck.com/advisories/weaver-e-cology-8.0-unauthenticated-path-traversal-via-ln-filedownload
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.