CVE-2024-25693 Portal for ArcGIS has a directory traversal vulnerability.

What is CVE-2024-25693?

CVE-2024-25693 is a critical path traversal vulnerability in Esri Portal for Arcgis, published on 4 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

There is a path traversal in Esri Portal for ArcGIS versions <= 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file system to access files or execute code outside of the intended directory.

Weakness: CWE-22

Which versions are affected by CVE-2024-25693?

It affects 1 product.

Products include Esri Portal for Arcgis.

How do I fix CVE-2024-25693?

No fix has been published for CVE-2024-25693 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-25693 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-25693 exists.

Other vulnerabilities in Esri Portal for Arcgis

• CVE-2026-13019 Missing Authentication Critical 9.8
• CVE-2026-33518 Incorrect privilege assignment in Portal for ArcGIS Critical 9.8
• CVE-2026-33519 Incorrect privilege assignment in Portal for ArcGIS Critical 9.8
• CVE-2025-2538 BUG-000174336 Critical 9.8
• CVE-2025-4967 Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS Critical 9.1

All Esri Portal for Arcgis vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-85r2-29g6-f4w7.