{"id":"CVE-2018-18809","published":"2019-03-07T22:29:00Z","modified":"2026-06-17T01:47:56Z","title":"TIBCO JasperReports Library Directory Traversal Vulnerability","vendor":"TIBCO","product":"JasperReports","tier":"core","eol":null,"description":{"text":"The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.","provenance":"source","from":"NVD"},"summary":{"text":"The TIBCO JasperReports Library default server implementation, along with the related JasperReports Library, Community Edition, ActiveMatrix BPM, JasperReports Server, and Jaspersoft for AWS offerings, contains a directory traversal flaw (improper limitation of a pathname to a restricted directory). An attacker with network access and low-privileged authenticated access to the web server can read contents of the host system, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:25Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.79064,"percentile":0.99596,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-12-29","dueDate":"2023-01-19","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809; https://nvd.nist.gov/vuln/detail/CVE-2018-18809","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-12-29","exploitedFirstSeen":"2022-12-29","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-12-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-21&host_type=src&vulnerability=cve-2018-18809","date":"2026-09-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-22&host_type=src&vulnerability=cve-2018-18809","date":"2026-09-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-25&host_type=src&vulnerability=cve-2018-18809","date":"2026-09-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-27&host_type=src&vulnerability=cve-2018-18809","date":"2026-09-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-28&host_type=src&vulnerability=cve-2018-18809","date":"2026-09-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2018-18809","date":"2026-09-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-02&host_type=src&vulnerability=cve-2018-18809","date":"2026-10-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-03&host_type=src&vulnerability=cve-2018-18809","date":"2026-10-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-09&host_type=src&vulnerability=cve-2018-18809","date":"2026-10-09"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2019/Sep/17","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/107351","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.tibco.com/services/support/advisories","tags":["Vendor Advisory"]},{"url":"https://cybersecurityworks.com/zerodays/cve-2018-18809-tibco.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2019/Sep/17","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/107351","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.tibco.com/services/support/advisories","tags":["Vendor Advisory"]},{"url":"https://cybersecurityworks.com/zerodays/cve-2018-18809-tibco.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-18809","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote web-facing app traversal exploitation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"contains a directory-traversal vulnerability that may theoretically allow web server users","start":406,"end":496}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Traversal enables reading host file contents","mappingType":"primary_impact","evidence":[{"from":"description","quote":"may theoretically allow web server users to access contents of the host system","start":456,"end":534}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-10525","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-10525","exploited":true,"exploitedSince":"2022-12-29","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2018-18809","name":"TIBCO JasperReports Library - Directory Traversal","severity":"medium","path":"http/cves/2018/CVE-2018-18809.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-18809.yaml"}],"provenance":"source"},"exploitRefs":["https://cybersecurityworks.com/zerodays/cve-2018-18809-tibco.html","https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html","http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2019-03-07","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18809","provenance":"source"},{"date":"2022-12-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-12-29","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-12-29","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-10525","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1393},"priority":{"score":67.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1402 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9960"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 NVD exploit link; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}