CVE-2021-3823: Path traversal vulnerability in Bitdefender GravitZone Update Server in relay mode

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-28 · updated 2026-06-17
Weakness: CWE-22

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects: Bitdefender GravityZone versions prior to 3.3.8.249.

Affected products

Bitdefender GravityZone: before 3.3.8.249 — fixed in 3.3.8.249

How to fix

Upgrade to a fixed version: Bitdefender GravityZone 3.3.8.249. Check the vendor advisory for mitigations.

References

https://www.bitdefender.com/support/security-advisories/path-traversal-vulnerability-in-bitdefender-gravitzone-update-server-in-relay-mode-va-10039/
https://www.bitdefender.com/support/security-advisories/path-traversal-vulnerability-in-bitdefender-gravitzone-update-server-in-relay-mode-va-10039/

Get alerted when CVE-2021-3823 or the next vulnerability affects your stack