CVE-2014-3914: Rocket ServerGraph Admin Center path traversal and arbitrary file actions

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote path traversal leading to arbitrary file read, write, delete, and code execution with a CVSS 2.0 score of 10 and high EPSS probability.

What it is

Rocket ServerGraph 1.2 Admin Center exposes fileRequestor and userRequest servlets that accept a query parameter without sanitizing path traversal sequences. Attackers can create, read, execute, or delete arbitrary files, and a save_server_groups action permits arbitrary code execution. The flaw is remotely reachable and unauthenticated, making it a full compromise of the host running the Admin Center.

Impact

An attacker gains arbitrary file read, write, and delete on the server plus remote code execution, effectively full control of the affected system. No credentials are required, so any network-reachable instance is at risk.

Attack surface

Reached over the network via HTTP requests to the Admin Center servlets (fileRequestor, userRequest, fileRequestServlet) with crafted query parameters. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are needed.

Exploitation

A public Exploit-DB entry exists and EPSS is 0.726 (99.4th percentile), indicating high likelihood of exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild campaign is documented in this record.

What to do

• Apply the vendor patch for Rocket ServerGraph 1.2 or upgrade to a fixed release; verify with Rocket Software advisories.
• Restrict network access to the Admin Center so only trusted management hosts can reach the servlets.
• Require authentication and place the Admin Center behind a reverse proxy that blocks traversal sequences in request paths and parameters.
• Run the Admin Center with least-privilege OS permissions so file write and execute actions cannot reach sensitive paths.
• Monitor and alert on unexpected file creation, deletion, or process execution originating from the Admin Center service account.

Detection

• Inspect web logs for requests to fileRequestor, userRequest, or fileRequestServlet containing '..' or encoded traversal sequences in query parameters.
• Alert on writeDataFile, readDataFile, run, runClear, save_server_groups, or del actions in Admin Center request logs.
• Monitor file system changes and new process spawns under the Admin Center service account for signs of arbitrary file write or code execution.
• Correlate outbound or lateral traffic from the Admin Center host to detect post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.