CVE-2016-0709: Apache Jetspeed Portal Site Manager path traversal enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw yields remote code execution, public exploits exist, and EPSS is very high, but exploitation requires authenticated administrator access, which limits exposure.

What it is

The Import/Export function in Apache Jetspeed's Portal Site Manager fails to sanitize ZIP archive entry names, allowing directory traversal via '..' sequences. A remote authenticated administrator can write files outside the intended directory, including JSP files into webapps, and thereby execute arbitrary code. The flaw is fixed in Jetspeed 2.3.1.

Impact

An attacker with administrator rights gains arbitrary file write on the server, which leads to remote code execution under the web application's privileges. This effectively converts a privileged portal account into full control of the host.

Attack surface

Reached over the network through the Portal Site Manager Import/Export feature by submitting a crafted ZIP archive; the CVSS vector (AV:N/AC:L/PR:H/UI:N) indicates no user interaction but high privileges (administrator) are required.

Exploitation

Public exploit code exists (Exploit-DB 39643, Packet Storm, Rapid7 module, haxx.ml writeup), and EPSS is 0.775 (99.5th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade Apache Jetspeed to 2.3.1 or later, which fixes the traversal in the Import/Export function.
• If upgrade is not immediately possible, restrict or disable the Portal Site Manager Import/Export feature for untrusted administrators.
• Limit administrator accounts to the minimum necessary and audit who holds them.
• Run Jetspeed with least privilege and ensure the web application user cannot write outside its intended directories.
• Apply a WAF or input filter that rejects ZIP entries containing '..' path sequences.

Detection

• Monitor web server and application logs for Import/Export requests containing '..' or suspicious ZIP upload activity.
• Alert on new or modified JSP files appearing in webapps or other web-served directories.
• Watch for unexpected file writes by the Jetspeed process outside its normal deployment paths.
• Review administrator account activity for anomalous portal import operations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.