CVE-2021-47978 — ProcessMaker 3.5.4 Local File Inclusion via Path Traversal
ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. …
Published: 2026-05-16 · CVSS: 6.9 · CVSS 4.0
ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7