CVE-2017-1000170: jqueryFileTree directory traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable arbitrary file read with public exploit references and very high EPSS, though no KEV listing or confirmed in-the-wild activity is recorded.

What it is

jqueryFileTree 2.1.5 and older contains a path traversal flaw (CWE-22) that lets a remote client request files outside the intended directory. Because the component is a file-browsing library, exposure can leak arbitrary readable files from the web server. The record is thin: no affected-version detail beyond '2.1.5 and older' and no vendor advisory text.

Impact

An unauthenticated attacker can read files outside the configured root, potentially exposing source code, configuration and credential files. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via HTTP requests to the file-listing endpoint; the CVSS vector shows no privileges and no user interaction required. Any deployment exposing jqueryFileTree to untrusted clients is in scope.

Exploitation

Not listed in CISA KEV, but EPSS is 0.59063 (99th percentile) and both references carry an Exploit tag, including a WordPress plugin path traversal writeup, indicating public exploit code exists.

What to do

• Upgrade jqueryFileTree past 2.1.5 or apply the fix referenced in the project issue tracker.
• If upgrade is not possible, restrict the file-listing endpoint to authenticated users and validate/canonicalize requested paths against an allowlist.
• Run the web service with least privilege and block access to sensitive directories via server configuration.
• Review WordPress or other CMS plugins bundling jqueryFileTree 1.6.6 or earlier and update them.
• Place the component behind a WAF rule that rejects traversal sequences in file path parameters.

Detection

• Search web logs for traversal sequences (../, ..%2f, encoded variants) in requests to jqueryFileTree endpoints.
• Alert on requests returning files outside the web root or unusual file types from the file-listing handler.
• Inventory assets and plugins embedding jqueryFileTree versions 2.1.5 and older.
• Monitor for repeated 200 responses to path parameters containing directory separators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.