CVE-2018-18809

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

• CWE-22
• CWE-22

• http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Sep/17Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/107351Broken Link, Third Party Advisory, VDB Entry
• http://www.tibco.com/services/support/advisoriesVendor Advisory
• https://cybersecurityworks.com/zerodays/cve-2018-18809-tibco.htmlExploit, Third Party Advisory
• https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.htmlExploit, Third Party Advisory
• https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809Vendor Advisory
• http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Sep/17Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/107351Broken Link, Third Party Advisory, VDB Entry
• http://www.tibco.com/services/support/advisoriesVendor Advisory
• https://cybersecurityworks.com/zerodays/cve-2018-18809-tibco.htmlExploit, Third Party Advisory
• https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.htmlExploit, Third Party Advisory
• https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-18809US Government Resource

Published

Mar 7, 2019

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-18803Curriculum Evaluation System 1.0 allows SQL Injection via th…
• CVE-2018-18804Bakeshop Inventory System 1.0 has SQL injection via the logi…
• CVE-2018-18805Point Of Sales 1.0 allows SQL injection via the login screen…9.8
• CVE-2018-18806School Equipment Monitoring System 1.0 allows SQL injection …
• CVE-2018-18807The web application of the TIBCO Statistica component of TIB…7.6
• CVE-2018-18808The domain management component of TIBCO Software Inc.'s TIB…8.8
• CVE-2018-18810The Administrator Service component of TIBCO Software Inc.'s…6.8
• CVE-2018-18811Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-18812The Spotfire Library component of TIBCO Software Inc.'s TIBC…6.5
• CVE-2018-18813The Spotfire web server component of TIBCO Software Inc.'s T…8.8
• CVE-2018-18814The TIBCO Spotfire authentication component of TIBCO Softwar…8.8
• CVE-2018-18815The REST API component of TIBCO Software Inc.'s TIBCO Jasper…10