CVE-2021-30497: Ivanti Avalanche unauthenticated path traversal in image endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote arbitrary file read with a public exploit advisory and very high EPSS, though not in KEV and requiring network reach to the Avalanche web interface.

What it is

Ivanti Avalanche (Premise) 6.3.2 fails to validate the imageFilePath parameter on the /AvalancheWeb/image endpoint, allowing absolute path traversal. A remote unauthenticated attacker can read arbitrary files from the server filesystem, exposing configuration and credential material.

Impact

An attacker gains read access to any file the Avalanche service account can reach, including sensitive system files such as C:/Windows/system32/config/system.sav. This can leak credentials, configuration and other data useful for follow-on compromise.

Attack surface

Reachable over the network via HTTP requests to the /AvalancheWeb/image endpoint with a crafted imageFilePath value. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.9658, 99.88th percentile) and a public SSD disclosure advisory with an Exploit tag exists, indicating public exploit detail is available.

What to do

• Apply the vendor patch referenced in the Ivanti security alert for CVE-2021-30497.
• If patching is delayed, restrict network access to the Avalanche web interface to trusted management networks only.
• Validate or normalize the imageFilePath parameter server-side and reject absolute paths or traversal sequences.
• Run the Avalanche service under a least-privilege account to limit which files are readable.
• Monitor vendor advisories for updated fixed versions since the record only names 6.3.2.

Detection

• Inspect web logs for requests to /AvalancheWeb/image with imageFilePath values containing absolute paths, drive letters, or ../ sequences.
• Alert on access to sensitive paths such as system.sav, web.config, or other configuration files via the image endpoint.
• Baseline normal imageFilePath values and flag outliers or unusually long path strings.
• Correlate repeated image endpoint requests from a single source with scanning or enumeration behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.