LiveActive security incident?Get immediate response
CVE Record

CVE-2021-39180: Path Traversal in Archive Handling Leading to Code Execution

OpenOLAT is a web-based learning management system (LMS). A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user (e.g. the tomcat user). Depending on the configuration this can be limited to files of the OpenOlat user data directory, however, if not properly set up, the attack could also be used to overwrite application server config files, java code or even operating system files. The attack could be used to corrupt or modify any OpenOlat file such as course structures, config files or temporary test data. Those attack would require in-depth knowledge of the installation and thus more theoretical. If the app server configuration allows the execution of jsp files and the path to the context is known, it is also possible to execute java code. If the app server runs with the same user that is used to deploy the OpenOlat code or has write permissions on the OpenOlat code files and the path to the context is know, code injection is possible. The attack requires an OpenOlat user account to upload a ZIP file and trigger the unzip method. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18, 15.5.3 and 16.0.0. There are no known workarounds aside from upgrading.

HighCVSS 8.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

OpenOLAT could unzip a malicious archive in a way that overwrites files the application server user can write. An authenticated OpenOLAT user could corrupt learning content or configuration, and in weaker server setups potentially reach code execution. The vendor fixed this in 15.3.18, 15.5.3, and 16.0.0.

Executive priority

Prioritize remediation for internet-facing or broadly used OpenOLAT systems, especially education platforms with many authenticated users. This is not described as unauthenticated or known-exploited, but the potential impact includes integrity loss, service disruption, and configuration-dependent code execution.

Technical view

CVE-2021-39180 is a CWE-22 path traversal flaw in OpenOLAT ZIP handling. A low-privileged authenticated user can upload a crafted ZIP and trigger extraction, causing arbitrary writable-file overwrite. Impact depends on filesystem permissions and app-server JSP/deployment configuration, ranging from data corruption to possible Java code execution.

Likely exposure

Exposure is limited to OpenOLAT deployments running affected versions and allowing authenticated users to upload ZIP files that reach the vulnerable unzip path. Unregistered users cannot exploit it according to the supplied advisory. Risk is higher where the app server user can write deployment, configuration, code, or OS files.

Exploitation context

The bundle reports no CISA KEV listing and supplies no active exploitation evidence. Exploitation requires an OpenOLAT account plus installation-specific knowledge for more severe outcomes. The advisory describes code execution as configuration-dependent, especially where JSP execution or writable deployed code paths are available.

Researcher notes

Focus validation on version, archive extraction exposure, and deployment permissions. The severe path requires writable targets and sometimes known context paths or JSP execution. Avoid assuming RCE in every deployment; the source frames that outcome as dependent on app-server configuration and filesystem layout.

Mitigation direction

  • Upgrade OpenOLAT to 15.3.18, 15.5.3, 16.0.0, or a later fixed version.
  • Treat upgrade as the primary mitigation; the advisory states no known workaround aside from upgrading.
  • Restrict the application server user's write permissions to the minimum required paths.
  • Review app-server settings that allow JSP execution or writable deployed application code.
  • Check vendor guidance and release notes before applying compensating controls.

Validation and detection

  • Inventory all OpenOLAT instances and record exact deployed versions.
  • Confirm no instance runs below 15.3.18, or 15.4.x below 15.5.3.
  • Identify roles or workflows that permit ZIP uploads and archive extraction.
  • Review filesystem permissions for the Tomcat or application server user.
  • Look for unexpected changes to OpenOLAT files, course structures, config, or temporary test data.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-22: File access and web shell behavior lookup

File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
description · low confidence lookup

File access behavior lookup

The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-39180 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H2.85.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.1High
CVSS 3.1 vector shape for CVE-2021-39180Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
OpenOLATOpenOLAT< 15.3.18, >= 15.4.0, < 15.5.3Listed
Weakness

CWE details

CWE-22

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-22 · source CWE mapping

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs