CVE-2016-2164

7.5 highEPSS 7.0%

The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 7.0% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2016-04-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:openmeetings

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-f6vf-465r-h42p	Maven	org.apache.openmeetings:openmeetings-parent	<3.1.1	3.1.1

References

http://openmeetings.apache.org/security.html
http://packetstormsecurity.com/files/136434/Apache-OpenMeetings-3.0.7-Arbitary-File-Read.html
http://www.securityfocus.com/archive/1/537887/100/0/threaded
https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOG
http://openmeetings.apache.org/security.html

Check your stack JSON