CVE-2017-16806: Ulterius Server HTTP directory traversal in Process function

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is remotely exploitable without authentication, public exploit code exists and EPSS is very high, though it is not in KEV and only affects confidentiality.

What it is

The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 fails to properly sanitize HTTP request paths, allowing directory traversal. An unauthenticated remote attacker can read files outside the intended web root, which matters because the server is network-exposed and the flaw requires no credentials or user interaction.

Impact

An attacker gains read access to arbitrary files on the host that the Ulterius service account can reach, potentially exposing configuration, credentials or other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via HTTP requests to the Ulterius web server; the CVSS vector shows no privileges required and no user interaction, so any host that can reach the service can attempt it.

Exploitation

A public Exploit-DB entry exists (EDB-43141), indicating exploit code is available, and EPSS is very high at 0.915 (99.8th percentile). The CVE is not listed in CISA KEV, so there is no confirmed in-the-wild exploitation record in this data.

What to do

• Upgrade Ulterius to 1.9.5.0 or later, which contains the fix commit 770d1821de43cf1d0a93c79025995bdd812a76ee.
• If immediate upgrade is not possible, restrict network access to the Ulterius HTTP service to trusted hosts only.
• Run the Ulterius service under a low-privilege account with access limited to required files.
• Place the service behind a reverse proxy or WAF that normalizes and rejects traversal sequences in request paths.

Detection

• Monitor HTTP request logs for path traversal patterns such as ../, ..%2f, %2e%2e/ and encoded variants targeting the Ulterius web server.
• Alert on requests returning files outside the expected web root or unusual file types from the Ulterius service.
• Baseline normal request paths to the Ulterius HTTP endpoint and flag deviations, especially from unexpected source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.