CVE-2021-47755 Oliver Library Server v5 - Arbitrary File Download
Unauthenticated attackers can download arbitrary system files from Oliver Library Server v5 by manipulating the fileName parameter in the FileServlet endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47755?
CVE-2021-47755 is a high-severity path traversal vulnerability in Softlink Education Oliver Library Server, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized input in the FileServlet endpoint. Attackers can exploit the vulnerability by manipulating the 'fileName' parameter to download sensitive files from the server's filesystem.
Weakness: CWE-22
Which versions are affected by CVE-2021-47755?
It affects 1 product.
Products include Softlinkint Oliver V5 Library.
How do I fix CVE-2021-47755?
No fix has been published for CVE-2021-47755 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-47755 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47755 exists.
Other vulnerabilities in Softlink Education Oliver Library Server
Sources
Also known as GHSA-c22c-g99c-vw87.