CVE-2021-4463

8.7 highEPSS 1.5%

High (8.7). EPSS 1.5% chance of exploitation in the next 30 days.

Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWEs: CWE-22, CWE-552
Published: 2025-11-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://cxsecurity.com/issue/WLB-2021070173
https://exchange.xforce.ibmcloud.com/vulnerabilities/206477
https://packetstormsecurity.com/files/163702
https://web.archive.org/web/20220527162453/http://www.ljkj2012.com/
https://www.exploit-db.com/exploits/50163

Check your stack JSON