CVE-2018-7719: Acrolinx Server on Windows directory traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote, unauthenticated file disclosure with a public exploit and very high EPSS percentile, though no confirmed in-the-wild or KEV activity.

What it is

Acrolinx Server before 5.2.5 on Windows is vulnerable to directory traversal (CWE-22), allowing crafted paths to reach files outside the intended web root. The flaw is remotely reachable without authentication, so any exposed instance is a candidate for probing.

Impact

An attacker can read arbitrary files on the host that the Acrolinx Server process can access, exposing configuration, credentials or other sensitive data. The CVSS vector shows high confidentiality impact with no integrity or availability effect.

Attack surface

Reached over the network via HTTP with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Any internet- or intranet-exposed Acrolinx Server on Windows is in scope.

Exploitation

No CISA KEV listing, but a public Exploit-DB entry (44345) exists and EPSS is 0.46874 (98.8th percentile), indicating meaningful and elevated exploitation likelihood.

What to do

• Upgrade Acrolinx Server to 5.2.5 or later on Windows; this is the only complete fix.
• If immediate upgrade is not possible, restrict network access to the Acrolinx Server to trusted hosts and place it behind an authenticating reverse proxy.
• Run the Acrolinx Server service under a low-privilege account with minimal filesystem read access to limit what traversal can reach.
• Review and rotate any credentials or secrets stored in files readable by the Acrolinx Server process.
• Monitor vendor advisories for further guidance on the affected 5.1 and subsequent service releases.

Detection

• Inspect web server and Acrolinx logs for requests containing traversal sequences such as ../, ..\, or encoded variants (%2e%2e) targeting file paths.
• Alert on HTTP requests to the Acrolinx Server that reference Windows system paths or configuration files outside expected application directories.
• Baseline normal file access by the Acrolinx Server process and flag reads of files outside its install and data directories.
• Correlate outbound or internal access to known Acrolinx Server endpoints with anomalous file-read patterns from the service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.