CVE-2018-18809: TIBCO JasperReports directory traversal exposes host files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCISA KEV listing, very high EPSS score, and public exploit references indicate active exploitation, though the CVSS score is medium and impact is confidentiality-only.

What it is

The default server implementation in multiple TIBCO JasperReports Library, JasperReports Server, and Jaspersoft products contains a directory-traversal flaw (CWE-22) that lets web server users read files from the host system. It affects a wide range of releases across the JasperReports and Jaspersoft product lines, so unpatched deployments are broadly exposed.

Impact

An attacker with a low-privileged account can read arbitrary files on the host, potentially exposing configuration, credentials, and other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via the web server (AV:N) with low privileges required (PR:L) and no user interaction (UI:N). The traversal is triggered through normal web requests to the affected server implementation.

Exploitation

The vulnerability is listed in CISA KEV (added 2022-12-29) and has a very high EPSS probability (0.79, ~99.6th percentile), and multiple references are tagged as exploits, indicating active exploitation and public exploit availability.

What to do

• Apply the vendor updates referenced in the TIBCO security advisory for CVE-2018-18809.
• Upgrade JasperReports Library, JasperReports Server, and Jaspersoft products to versions beyond the affected ranges listed in the advisory.
• Restrict network access to JasperReports/Jaspersoft servers to trusted users and networks.
• Enforce least privilege on service accounts and file system permissions to limit what a traversal can read.
• Monitor for and block path traversal patterns in requests to the reporting server.

Detection

• Inspect web server and application logs for requests containing ../ or encoded traversal sequences (e.g., %2e%2e%2f) targeting JasperReports endpoints.
• Alert on unusual file access by the JasperReports service account outside expected directories.
• Monitor for known exploit request patterns against JasperReports/Jaspersoft URLs.
• Correlate outbound or file-read activity from the reporting server with suspicious client IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.