CVE-2019-12314: Deltek Maconomy path traversal local file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication required and public exploit code plus very high EPSS make this an urgent exposure despite no KEV listing.

What it is

Deltek Maconomy 2.2.5 is vulnerable to local file inclusion through absolute path traversal in the WS.macx1.W_MCS PATH_INFO, allowing an unauthenticated remote attacker to read arbitrary files from the server. The flaw is trivially reachable over HTTP and carries a critical CVSS score of 9.8, making it a serious exposure for internet-facing Maconomy deployments.

Impact

An attacker can read arbitrary files on the host, including sensitive configuration and credential files such as /etc/passwd, which can enable further compromise. The CVSS vector indicates high confidentiality, integrity and availability impact, though the description only demonstrates file disclosure.

Attack surface

The flaw is reached remotely over the network via the Maconomy web service PATH_INFO, as shown by the cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Public exploit code is referenced in Packet Storm and GitHub advisories, and EPSS is 0.8422 (99.7th percentile), indicating a high likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is documented in this record.

What to do

• Apply the vendor patch or upgrade Deltek Maconomy to a fixed release; no fixed version is stated in this record, so confirm with Deltek.
• Restrict network access to the Maconomy web service and cgi-bin endpoints to trusted networks only.
• Deploy a WAF rule to block path traversal sequences such as ../ and absolute paths in PATH_INFO.
• Run the Maconomy service with least privilege and isolate it from sensitive host files.
• Monitor and alert on anomalous file-read requests to the Maconomy web service.

Detection

• Inspect web server and Maconomy logs for requests containing ../ or absolute paths like /etc/passwd in the URI.
• Alert on requests to cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS with unusual PATH_INFO values.
• Monitor for outbound or local file access patterns consistent with LFI from the Maconomy process.
• Use file integrity monitoring on sensitive system files to detect unauthorized reads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.