# CVE-2016-8204: Brocade Network Advisor directory traversal in FileReceiveServlet

Source: https://junglewise.ai/threats/cve-2016-8204-brocade-network-advisor-directory-traversal-in-filereceiveservlet  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-14. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-8204 · Severity: critical · CVSS 9.8 · Published 2017-01-14

Brocade Network Advisor is a management platform used to monitor and configure storage area networks (SANs). A critical security flaw allows an unauthenticated attacker to remotely upload malicious files to the server. This could lead to a complete takeover of the management system, potentially disrupting network operations or allowing unauthorized access to sensitive infrastructure configurations.

Technologies: [Brocade Network Advisor](https://junglewise.ai/threats/technologies/network-advisor). Vendors: [Broadcom](https://junglewise.ai/threats/vendors/broadcom), [Brocade](https://junglewise.ai/threats/vendors/brocade).

## Quick answers

**Is CVE-2016-8204 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-8204 being exploited in the wild.

**How severe is CVE-2016-8204?** Critical severity, with a CVSS score of 9.8, published 14 January 2017.

**Which products and versions are affected?** Brocade Network Advisor Versions up to and including 14.0.2.

**Is there a fix for CVE-2016-8204?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-8204 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-8204?** Check whether you run Broadcom Brocade Network Advisor or Brocade Network Advisor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A directory traversal vulnerability exists in the FileReceiveServlet component of Brocade Network Advisor due to insufficient validation of user-supplied paths during file upload operations. An unauthenticated remote attacker can exploit this by sending a specially crafted request to upload a malicious file (such as a web shell) into a directory where it can be executed. Successful exploitation allows for arbitrary code execution with SYSTEM privileges. The vulnerability is fixed in Brocade Network Advisor versions 14.0.3, 14.1.1, and later.

## Affected products

- Brocade Network Advisor Versions up to and including 14.0.2

## Timeline

- 2016-10-17: disclosed: Vulnerability reported to vendor via ZDI
- 2017-01-06: advisory: Initial vendor advisory published by Brocade
- 2017-01-14: advisory: NVD publication date

## References

- [http://www.securityfocus.com/bid/95695](http://www.securityfocus.com/bid/95695)
- [http://www.zerodayinitiative.com/advisories/ZDI-17-049](http://www.zerodayinitiative.com/advisories/ZDI-17-049)
- [https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03785en_us](https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03785en_us)
- [https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-177](https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-177)

## Related threats

- [Brocade Network Advisor directory traversal in CliMonitorReportServlet](https://junglewise.ai/threats/cve-2016-8207-brocade-network-advisor-directory-traversal-in)
- [Brocade Network Advisor directory traversal in SoftwareImageUpload servlet](https://junglewise.ai/threats/cve-2016-8206-brocade-network-advisor-directory-traversal-in-softwareimageupload)
- [Brocade Network Advisor directory traversal in DashboardFileReceiveServlet](https://junglewise.ai/threats/cve-2016-8205-brocade-network-advisor-directory-traversal-in)