Vulnerability record · CVE-2014-7866 · published 10 December 2014
CVE-2014-7866: ManageEngine OpManager, IT360 and Social IT Plus path traversal file upload RCE
Zohocorp · Manageengine Social It Plus
ZOHO ManageEngine OpManager 8 through 11.4, IT360 10.3/10.4 and Social IT Plus 11.0 contain directory traversal flaws in the MigrateLEEData and MigrateCentralData servlets. Attackers can use .. sequences in the fileName and zipFileName parameters to write arbitrary files outside the intended directory. Because the written files can be executed, this becomes remote code execution.
Description
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName parameter to the MigrateLEEData servlet or (2) zipFileName parameter in a downloadFileFromProbe operation to the MigrateCentralData servlet.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
critical priorityUnauthenticated network-accessible path traversal leading to arbitrary file write and code execution, with public exploit code and very high EPSS.
What it is
ZOHO ManageEngine OpManager 8 through 11.4, IT360 10.3/10.4 and Social IT Plus 11.0 contain directory traversal flaws in the MigrateLEEData and MigrateCentralData servlets. Attackers can use .. sequences in the fileName and zipFileName parameters to write arbitrary files outside the intended directory. Because the written files can be executed, this becomes remote code execution.
Impact
An attacker can write and execute arbitrary files on the server, leading to full compromise of the ManageEngine host. This can expose managed network data and provide a foothold for lateral movement.
Attack surface
Reachable over the network via HTTP requests to the MigrateLEEData and MigrateCentralData servlets. The CVSS vector indicates no authentication is required (Au:N), and no user interaction is described.
Exploitation
Public exploit code is referenced in the advisory and Full Disclosure links, and EPSS is very high (0.79759, 99.6th percentile). The CVE is not listed in CISA KEV.
What to do
- Apply the vendor fix referenced in the ZOHO ManageEngine support article for the remote code execution via file upload vulnerability.
- Upgrade OpManager, IT360 and Social IT Plus to versions later than the affected builds listed (OpManager 11.4 and earlier, IT360 10.3/10.4, Social IT Plus 11.0).
- Restrict network access to the ManageEngine web interface and servlet endpoints to trusted management networks only.
- Run the ManageEngine service with least privilege and ensure the web-accessible directories are not writable by the service account where possible.
- Monitor and block traversal patterns such as .. in fileName and zipFileName parameters at the web application firewall.
Detection
- Search web and proxy logs for requests to MigrateLEEData or MigrateCentralData containing .. or encoded traversal sequences in fileName or zipFileName parameters.
- Monitor the ManageEngine installation directories and web root for newly created or modified executable files (JSP, WAR, scripts).
- Alert on unexpected outbound connections or child processes spawned by the ManageEngine service.
- Review file integrity monitoring for changes in directories writable by the ManageEngine service account.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-7866 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-7866), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
