Path Traversal in Elastic Maps Server
CVE-2026-78602
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process.
Vulnerability class: Path Traversal (Directory Traversal)
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Elastic Maps Server — versions 9.5.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-78602?
- CVE-2026-78602 is a medium-severity vulnerability in Elastic Maps Server, classified under Path Traversal. CVSS score: 5.3/10. Published 2026-09-02.
- How severe is CVE-2026-78602?
- Medium severity. CVSS v3 base score is 5.3 out of 10.