Authenticated file read via branding path traversal
Published Apr 20, 2021 · Updated Aug 12, 2026
Path traversal in SonicWall Email Security 10.0.9 and earlier allows remote authenticated users to read arbitrary host files. The branding feature's /dload_apps handler accepts encoded parent-directory sequences in its path parameter and resolves them outside the intended data/updates directory. Administrative access is required; the Tomcat service account can expose any operating-system file it can read, including stored account and directory credentials.
Summary
What happened
Path traversal in SonicWall Email Security 10.0.9 and earlier allows remote authenticated users to read arbitrary host files. The branding feature's /dload_apps handler accepts encoded parent-directory sequences in its path parameter and resolves them outside the intended data/updates directory. Administrative access is required; the Tomcat service account can expose any operating-system file it can read, including stored account and directory credentials.
The record
- CVE
- CVE-2021-20023
- Published
- Apr 20, 2021
- Updated
- Aug 12, 2026
- Vendor
- SonicWall
- Product
- Email Security
- Classifications
- CWE-22, T1005
- Attack vector
- network
- Privileges
- admin
Timeline
How it unfolded
- Mar 1, 2021Exploitation reportedUNC2682 Email Security exploitation
- Mar 1, 2021Exploitation reportedEmail Security three-vulnerability exploit chain
- Apr 20, 2021CVE publishedPublication date reported by the CVE source.
- Aug 12, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=10.0.9 and earlier
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- Mandiant /dload_apps traversal requestfunctional · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Reported exploitation
- CISA Known Exploited Vulnerabilities listingknown exploited catalog
- UNC2682 Email Security exploitationthreat actor
- Email Security three-vulnerability exploit chainexploit chain
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo