CVE-2014-5446: ManageEngine Netflow Analyzer and IT360 path traversal in DisplayChartPDF servlet

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityPublic exploit code exists and EPSS is very high, but the flaw is read-only and requires network reachability to the servlet, making it a serious but not critical risk.

What it is

The DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 does not properly sanitize the filename parameter, allowing directory traversal via '..' sequences. This lets an attacker read arbitrary files from the server filesystem, which can expose configuration data, credentials, or other sensitive content.

Impact

An attacker can read arbitrary files on the host, potentially obtaining credentials, configuration files, or other sensitive data that aids further compromise. The flaw is read-only, so it does not directly allow code execution or data modification.

Attack surface

The servlet is reachable over the network (AV:N) with no authentication required per the CVSS vector, though the description also notes remote authenticated users can exploit it. No user interaction is needed.

Exploitation

Public exploit code and proof-of-concept references are available, and EPSS indicates a high probability of exploitation activity (0.547, 98.9th percentile), but the vulnerability is not listed in CISA KEV.

What to do

• Apply the vendor fix referenced in the ZOHO ManageEngine support article for CVE-2014-5445 and CVE-2014-5446.
• Upgrade Netflow Analyzer beyond 10.2 and IT360 beyond 10.3 to a supported, patched release.
• Restrict network access to the DisplayChartPDF servlet and the management interface to trusted hosts only.
• Run the affected services with least privilege and avoid storing sensitive files on the same host.
• Monitor for traversal patterns in requests to the servlet and block them at a reverse proxy or WAF.

Detection

• Search web server and application logs for requests to DisplayChartPDF containing '..' or encoded traversal sequences in the filename parameter.
• Alert on outbound or unusual file reads from the ManageEngine process, especially access to files outside expected directories.
• Use file integrity monitoring on sensitive configuration and credential files to detect unexpected reads or access attempts.
• Review network traffic for requests to the servlet from untrusted sources or with suspicious filename values.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.