Executive brief
Elastic Maps Server is used to serve map data and geospatial content within the Elastic Stack. An unauthenticated attacker can exploit a path traversal vulnerability to read arbitrary files from the server's filesystem, potentially exposing sensitive configuration files, credentials, or other data that the server process can access.
Technical details
The vulnerability is an improper limitation of pathname validation (CWE-22) that allows path traversal attacks (CAPEC-126). An unauthenticated attacker with network access can craft requests containing directory traversal sequences (e.g., "../") to cause the server to return the contents of files outside its intended content directory. The vulnerability affects all configurations and requires no authentication, user interaction, or special preconditions. Affected versions include 8.x (8.19.11–8.19.18), 9.x (9.3.0–9.4.3), and 9.5.0. The fix is available in Elastic Maps Server 8.19.19, 9.4.4, and 9.5.1.
Affected products
- Elastic Maps Server 8.19.11–8.19.18, 9.3.0–9.4.3, 9.5.0
Timeline
- 2026-09-02: disclosed: CVE-2026-78602 published
- 2026-09-01: patched: Patches released: Elastic Maps Server 8.19.19, 9.4.4, 9.5.1