CVE-2018-5430: TIBCO JasperReports Server path traversal allows authenticated file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 8.8, active exploitation per CISA KEV, public exploit code, and very high EPSS make this a high-priority patching target despite requiring authentication.

What it is

The Spring web flows in TIBCO JasperReports Server and related Jaspersoft products are vulnerable to path traversal, letting any authenticated user read arbitrary files from the web application, including key configuration files. This exposes sensitive data such as credentials and configuration that can enable further compromise.

Impact

An attacker with a valid low-privileged account gains read-only access to application files and configuration, potentially harvesting secrets for lateral movement or privilege escalation.

Attack surface

Reachable over the network through the Spring web flows; authentication is required (PR:L) and no user interaction is needed (UI:N).

Exploitation

CISA KEV lists it as exploited, public exploit code exists (Exploit-DB 44623, Rhino Security Labs), and EPSS is 0.4963 (98.8th percentile).

What to do

• Apply the vendor updates referenced in the TIBCO security advisory for all affected JasperReports Server and Jaspersoft products.
• If immediate patching is not possible, restrict network access to the JasperReports Server web interface to trusted users and networks.
• Audit and rotate any credentials or secrets stored in configuration files that may have been exposed.
• Enforce least privilege and monitor authenticated accounts for unusual file access patterns.

Detection

• Monitor web logs for path traversal patterns (e.g., ../, encoded variants) in requests to Spring web flow endpoints.
• Alert on authenticated users accessing configuration or non-public files outside normal reporting paths.
• Review file access logs for reads of sensitive configuration files by application service accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.