CVE-2021-47755

Oliver Library Server v5 - Arbitrary File Download

CVSS 8.7 HIGHEPSS 0.8%CWE-22

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.7EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

15 Jan 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized input in the FileServlet endpoint. Attackers can exploit the vulnerability by manipulating the 'fileName' parameter to download sensitive files from the server's filesystem.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

Softlink Education · Oliver Library Server

References

https://www.exploit-db.com/exploits/50599 https://www.softlinkint.com/product/oliver/