Vulnerability record · CVE-2015-2856 · published 10 October 2017
CVE-2015-2856: Accellion File Transfer Appliance directory traversal via statecode cookie
Accellion · File Transfer Appliance
The template function in function.inc on Accellion File Transfer Appliance devices before FTA_9_11_210 fails to sanitize the statecode cookie, allowing directory traversal. A remote attacker can read arbitrary files from the appliance, which may expose credentials, configuration and other sensitive data.
Description
Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attackers to read arbitrary files via a .. (dot dot) in the statecode cookie.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated remote file read with a public exploit module and very high EPSS, though not observed in KEV or ransomware campaigns.
What it is
The template function in function.inc on Accellion File Transfer Appliance devices before FTA_9_11_210 fails to sanitize the statecode cookie, allowing directory traversal. A remote attacker can read arbitrary files from the appliance, which may expose credentials, configuration and other sensitive data.
Impact
An unauthenticated remote attacker gains read access to arbitrary files on the appliance, potentially disclosing secrets such as credentials or configuration data. There is no integrity or availability impact per the CVSS vector.
Attack surface
Reachable over the network through HTTP requests to the appliance, with no authentication or user interaction required (AV:N/PR:N/UI:N). The traversal payload is delivered in the statecode cookie.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.566, 99th percentile) and a public Rapid7 Metasploit scanner module exists, indicating exploit code is available.
What to do
- Upgrade Accellion File Transfer Appliance to FTA_9_11_210 or later.
- If patching is not immediately possible, restrict network access to the appliance to trusted sources and block untrusted HTTP traffic.
- Inspect and reject requests containing traversal sequences in the statecode cookie at a reverse proxy or WAF.
- Rotate credentials and secrets that may have been stored on or accessible from the appliance.
- Monitor vendor advisories for further guidance on this legacy product.
Detection
- Search web/proxy logs for requests with '..' or encoded traversal sequences in the statecode cookie.
- Alert on HTTP requests to the Accellion FTA template endpoint from unexpected or external source IPs.
- Monitor for use of the Rapid7 Metasploit module 'auxiliary/scanner/http/accellion_fta_statecode_file_read' against the appliance.
- Review file access and outbound traffic from the appliance for signs of data exfiltration.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.rapid7.com/db/modules/auxiliary/scanner/http/accellion_fta_statecode_file_read | ExploitThird Party Advisory |
| https://www.rapid7.com/db/modules/auxiliary/scanner/http/accellion_fta_statecode_file_read | ExploitThird Party Advisory |
Track CVE-2015-2856 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-2856), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
