CVE-2021-29101

7.5 highEPSS 2.3%

High (7.5) in esri arcgis geoevent server. EPSS 2.3% chance of exploitation in the next 30 days.

ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to perform directory traversal attacks and read arbitrary files on the system.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWEs: CWE-22, CWE-23
Published: 2021-05-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

esri:arcgis_geoevent_server

References

https://www.esri.com/arcgis-blog/products/ext-server-geoevent/administration/arcgis-geoevent-server-security-update-2021-patch-1
https://www.esri.com/arcgis-blog/products/ext-server-geoevent/administration/arcgis-geoevent-server-security-update-2021-patch-1

Check your stack JSON