CVE-2020-37041

HIGH

7.5

CVSS Severity Score

EPSS Score0.0600%

EPSS Percentile3.02th

PublishedJan 30, 2026

Last ModifiedFeb 13, 2026

Vulnerability Description

OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with path traversal sequences (e.g., '../') in the URL. For example, requesting /static/css//../../../../../../../../etc/passwd returns the contents of /etc/passwd. This vulnerability was discovered by Raif Berkay Dincel and confirmed on Linux Mint and Windows 10.

Affected Platforms (CPE)

📦

Citeum

Opencti

= 3.3.1

References & Advisories

🔗 https://github.com/OpenCTI-Platform/opencti

🔗 https://www.exploit-db.com/exploits/48595

🔗 https://www.opencti.io/

🔗 https://www.vulncheck.com/advisories/opencti-directory-traversal

Vulnerability Description

Affected Platforms (CPE)

Opencti

References & Advisories

Related Vulnerabilities