Vulnerability record · CVE-2011-4166 · published 27 December 2011
CVE-2011-4166: HP Managed Printing Administration path traversal allows arbitrary file creation
Hp · Managed Printing Administration
HP Managed Printing Administration before 2.6.4 contains a directory traversal flaw in the MPAUploader.Uploader.1.UploadFiles method. Crafted form data lets a remote attacker write files to arbitrary paths on the server. Because the affected component is a web-facing upload handler, the flaw matters for any unpatched installation reachable from the network.
Description
Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote, unauthenticated file creation with partial impact across all three CVSS categories and a very high EPSS percentile, though no confirmed exploitation is recorded.
What it is
HP Managed Printing Administration before 2.6.4 contains a directory traversal flaw in the MPAUploader.Uploader.1.UploadFiles method. Crafted form data lets a remote attacker write files to arbitrary paths on the server. Because the affected component is a web-facing upload handler, the flaw matters for any unpatched installation reachable from the network.
Impact
An attacker can create arbitrary files on the host, which can lead to code execution or service disruption depending on what files can be written and where. The CVSS 2.0 vector rates confidentiality, integrity and availability all as partial impact.
Attack surface
The vulnerability is reached over the network through the MPAUploader upload method, per the AV:N vector. The vector shows no authentication requirement (Au:N) and no user interaction, so any network client able to reach the service can attempt it.
Exploitation
No CISA KEV listing and no ransomware associations are recorded. EPSS is 0.5834 (99th percentile), indicating a high modeled probability of exploitation activity, but the record contains no confirmed in-the-wild exploitation report.
What to do
- Upgrade HP Managed Printing Administration to 2.6.4 or later per the HP advisory.
- If upgrade is not possible, restrict network access to the MPA upload interface to trusted hosts only.
- Validate and normalize uploaded filenames server-side, rejecting path separators and traversal sequences.
- Run the MPA service with least privilege and confine its write paths to a dedicated directory.
- Monitor the vendor advisory page for any updated guidance.
Detection
- Review web server and MPA logs for upload requests containing ../ or encoded traversal sequences in form data.
- Alert on file creation events in unexpected directories by the MPA service account.
- Baseline normal upload destinations and flag writes outside that set.
- Check for unexpected executable or script files appearing in web-accessible paths.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2011-4166 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2011-4166), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
