CVE-2014-6034: ManageEngine OpManager FileCollector servlet path traversal allows WAR upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw allows remote code execution via WAR upload, public exploit code exists, and EPSS is very high, though it is not in CISA KEV and the CVSS v2 base score is only 5.0.

What it is

A directory traversal flaw in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet lets an attacker place files outside the intended directory by putting a .. sequence in the regionID parameter. Because the servlet accepts WAR archives, this can result in writing and executing arbitrary code on the server. It affects ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier.

Impact

An attacker can write arbitrary WAR files to the server and have them executed, giving remote code execution in the context of the affected service. This can lead to full compromise of the ManageEngine host and any data it manages.

Attack surface

Reachable over the network through the FileCollector servlet; the description states remote attackers or remote authenticated users can trigger it, so no prior authentication is strictly required in all cases. No user interaction is indicated.

Exploitation

Public exploit code is referenced (Full Disclosure and a GitHub PoC), and EPSS is very high at 0.79 (99.6th percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply the vendor servlet vulnerability fix from the ZOHO ManageEngine support article, or upgrade to a fixed OpManager/Social IT Plus/IT360 release.
• If patching is not immediately possible, restrict network access to the FileCollector servlet and the affected management interfaces to trusted hosts only.
• Validate and reject path traversal sequences in the regionID parameter at the web server or reverse proxy layer.
• Run the affected ManageEngine services with least privilege and ensure the web application directory is not writable by the service account where avoidable.
• Monitor for unexpected WAR files appearing in web-accessible directories.

Detection

• Search web and servlet logs for requests to the FileCollector servlet containing '..' or encoded traversal sequences in the regionID parameter.
• Alert on new or modified .war files in the ManageEngine web application directories.
• Monitor for unexpected child processes or outbound connections originating from the ManageEngine service after servlet requests.
• Review file system integrity monitoring for writes outside expected upload paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.