What’s Vulnerable › Vulnerabilities

CVE-2021-47724: STVS ProVision Authenticated File Disclosure via archive.rb

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-09 · updated 2026-06-17
• Weakness: CWE-22

Description

STVS ProVision 5.9.10 contains a path traversal vulnerability that allows authenticated attackers to access arbitrary files by manipulating the files parameter in the archive download functionality. Attackers can send GET requests to /archive/download with directory traversal sequences to read sensitive system files like /etc/passwd.

Affected products

• STVS SA STVS ProVision: 5.5, 5.6, 5.7, 5.8.6, 5.9.0, 5.9.1 (+3)

References

• http://www.stvs.ch
• https://www.exploit-db.com/exploits/49481
• https://www.vulncheck.com/advisories/stvs-provision-authenticated-file-disclosure-via-archiverb
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5623.php

Get alerted when CVE-2021-47724 or the next vulnerability affects your stack