High severity7.5NVD Advisory· Published May 5, 2021· Updated Jun 17, 2026

CVE-2021-29101

Description

ArcGIS GeoEvent Server versions 10.8.1 and below has a read-only directory path traversal vulnerability that could allow an unauthenticated, remote attacker to perform directory traversal attacks and read arbitrary files on the system.

Affected products

Esri/Arcgis Geoevent Server
cpe:2.3:a:esri:arcgis_geoevent_server:*:*:*:*:*:*:*:*
Range: <=10.8.1
Esri/Arcgis Serverllm-fuzzy2 versions
<=10.8.1+ 1 more
- (no CPE)range: <=10.8.1
- (no CPE)range: All

Patches

Vulnerability mechanics

References

www.esri.com/arcgis-blog/products/ext-server-geoevent/administration/arcgis-geoevent-server-security-update-2021-patch-1nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000