What’s Vulnerable › Vulnerabilities

CVE-2021-47755: Oliver Library Server v5 - Arbitrary File Download

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-15 · updated 2026-06-17
• Weakness: CWE-22

Description

Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized input in the FileServlet endpoint. Attackers can exploit the vulnerability by manipulating the 'fileName' parameter to download sensitive files from the server's filesystem.

Affected products

• Softlink Education Oliver Library Server: before 8.00.008.053 — fixed in 8.00.008.053

How to fix

Upgrade to a fixed version: Softlink Education Oliver Library Server 8.00.008.053. Check the vendor advisory for mitigations.

References

• https://www.exploit-db.com/exploits/50599
• https://www.softlinkint.com/product/oliver/
• https://www.exploit-db.com/exploits/50599

Get alerted when CVE-2021-47755 or the next vulnerability affects your stack