CVE-2015-2996: SysAid Help Desk path traversal in file parameters allows file read and DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable file read and DoS with public exploit code and very high EPSS, though not in KEV and requiring the vulnerable pre-15.2 version.

What it is

SysAid Help Desk before 15.2 contains multiple directory traversal flaws in the fileName parameter of getGfiUpgradeFile and calculateRdsFileChecksum. An unauthenticated remote attacker can use .. sequences to read arbitrary files or exhaust CPU and memory. The file read exposes sensitive data, while the DoS path can degrade or take down the help desk service.

Impact

An attacker can read arbitrary files accessible to the SysAid service, potentially exposing configuration and credential material, and can cause a denial of service through CPU and memory consumption.

Attack surface

Reachable over the network via the getGfiUpgradeFile and calculateRdsFileChecksum endpoints with a crafted fileName parameter. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Public exploit references exist (Packet Storm and Full Disclosure tagged Exploit), and EPSS is 0.86643 (99.73rd percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV.

What to do

• Upgrade SysAid Help Desk to version 15.2 or later, which the vendor advisory identifies as the fixed release.
• If immediate upgrade is not possible, restrict network access to the SysAid web interface to trusted networks or place it behind an authenticated reverse proxy.
• Validate and normalize the fileName parameter server-side, rejecting any path containing .. or absolute path components.
• Run the SysAid service with least privilege and limit its filesystem read access to only required directories.
• Monitor and rate-limit requests to getGfiUpgradeFile and calculateRdsFileChecksum to reduce DoS impact.

Detection

• Search web access logs for requests to getGfiUpgradeFile or calculateRdsFileChecksum containing .. or encoded traversal sequences in the fileName parameter.
• Alert on unusual file read patterns or errors from the SysAid process that indicate access outside expected directories.
• Monitor for spikes in CPU or memory usage correlated with requests to the affected endpoints.
• Review SysAid application logs for repeated or anomalous calls to the two vulnerable handlers from single source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.