Vulnerability · Published Jan 15, 2026 · Assigned by VulnCheck
CVE-2021-47755Oliver Library Server v5 - Arbitrary File Download
High 7.5
In plain English
A high-severity path traversal in Oliver Library Server from Softlink Education. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 42.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized input in the FileServlet endpoint. Attackers can exploit the vulnerability by manipulating the 'fileName' parameter to download sensitive files from the server's filesystem.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Softlink Education | Oliver Library Server | < 8.00.008.053 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- ExploitDB-50599 exploit
- Oliver Library Server Official Product Homepage product