OrbiTeam BSCW Server: Unauthenticated path traversal via style_name parameter

Summary

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains a path traversal vulnerability in the style_name parameter of the theme operation. A remote attacker without authentication can send crafted GET requests with ../ sequences to read local files on the server, such as /etc/passwd. Internet-facing instances are the main risk, and stored configuration files or credentials could enable follow-on compromise.

Affected

• OrbiTeam BSCW Server 5.0.0 to before 5.2.5
• OrbiTeam BSCW Server 7.0.0 to before 7.4.4
• Default configuration: Unknown.

Fixed in

• Upgrade to 5.2.5 or later (5.x branch)
• Upgrade to 7.4.4 or later (7.x branch)
• Check the current release on the vendor website, as newer releases exist.

Workaround

• No vendor-published workaround found. Unknown.
• Restrict public access to BSCW endpoints at a reverse proxy or firewall until patched.
• Review web logs for requests to bscw.cgi with op=theme and style_name containing ../.

Exploitation

• CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial.
• A Nuclei detection template and a Packet Storm entry exist; sources disagree on whether a working public exploit is available.
• VulnCheck lists the CVE in its KEV index; a third-party tracker states it is not known exploited. Not found in CISA KEV in our research.
• Exploitation date claims (Shadowserver, 2023-10-22) are unverified.

Our recommendation

• Inventory all BSCW instances, including those hosted by external providers.
• Verify the installed version and upgrade to 5.2.5, 7.4.4 or the current vendor release.
• If an instance was exposed while vulnerable, review logs and rotate credentials stored on the server.
• Restrict internet exposure of BSCW where it is not required.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Nuclei template orbiteam-bscw-server-lfi.yaml github.com
• Packet Storm entry 165156 packetstorm.news
• SEC Consult advisory (archived) web.archive.org
• VulnCheck advisory www.vulncheck.com
• VulDB entry 425268 vuldb.com
• VulnCheck advisories index www.vulncheck.com
• BSCW Administrator Manual 5.2 www.bscw.de

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:51.