CVE-2014-8741: Lexmark MarkVision Enterprise path traversal in GfdFileUploadServerlet allows arbitrary file write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, and arbitrary file write makes this a critical risk despite the lack of confirmed in-the-wild exploitation.

What it is

The GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 is vulnerable to directory traversal (CWE-22), letting remote attackers write files to arbitrary paths. Because the flaw permits unauthenticated file writes, it can lead to code execution or full system compromise.

Impact

An attacker can write arbitrary files on the server, which can be used to overwrite configuration or drop executable content and achieve remote code execution. Successful exploitation gives full control over confidentiality, integrity, and availability of the affected host.

Attack surface

The vulnerability is reachable over the network through the GfdFileUploadServerlet servlet; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are required.

Exploitation

No CISA KEV listing is present, but EPSS is very high (0.77198, 99.5th percentile), and the references include a Zero Day Initiative advisory, indicating public technical detail exists. No exploit code or active exploitation is confirmed by the record.

What to do

• Upgrade Lexmark MarkVision Enterprise to version 2.1 or later, which the vendor advisory states fixes the issue.
• If immediate upgrade is not possible, restrict network access to the MarkVision Enterprise web interface and the GfdFileUploadServerlet endpoint to trusted hosts only.
• Deploy a WAF or reverse proxy rule to block path traversal sequences (e.g., ../, ..\) in upload requests to the servlet.
• Run the MarkVision Enterprise service with least privilege and ensure its file system permissions prevent writes outside intended upload directories.
• Monitor the vendor advisory (TE666) and ZDI-14-410 for any updated guidance.

Detection

• Inspect web server and application logs for requests to GfdFileUploadServerlet containing traversal sequences such as ../ or encoded variants.
• Monitor file system changes in web-accessible and system directories for unexpected new or modified files.
• Alert on outbound network connections or process creation originating from the MarkVision Enterprise service account that are not part of normal operation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.