Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• f5 big-ip access policy manager10.1.0 and later · up to 10.2.4 inclusive
• f5 big-ip access policy manager11.0.0 and later · up to 11.3.0 inclusive
• f5 big-ip advanced firewall manager11.3.0
• f5 big-ip analytics11.0.0 and later · up to 11.3.0 inclusive
• f5 big-ip application security manager10.1.0 and later · up to 10.2.4 inclusive
• f5 big-ip application security manager11.0.0 and later · up to 11.3.0 inclusive
• f5 big-ip edge gateway10.1.0 and later · up to 10.2.4 inclusive
• f5 big-ip edge gateway11.0.0 and later · up to 11.3.0 inclusive
• f5 big-ip global traffic manager10.1.0 and later · up to 10.2.4 inclusive
• f5 big-ip global traffic manager11.0.0 and later · up to 11.3.0 inclusive
• f5 big-ip link controller10.1.0 and later · up to 10.2.4 inclusive
• f5 big-ip link controller11.0.0 and later · up to 11.3.0 inclusive
• f5 big-ip local traffic manager10.1.0 and later · up to 10.2.4 inclusive
• f5 big-ip local traffic manager11.0.0 and later · up to 11.3.0 inclusive
• f5 big-ip policy enforcement manager11.3.0
• f5 big-ip protocol security module10.1.0 and later · up to 10.2.4 inclusive
• f5 big-ip protocol security module11.0.0 and later · up to 11.3.0 inclusive
• f5 big-ip wan optimization manager10.1.0 and later · up to 10.2.4 inclusive
• f5 big-ip wan optimization manager11.0.0 and later · up to 11.3.0 inclusive
• f5 big-ip webaccelerator10.1.0 and later · up to 10.2.4 inclusive

Other highest-scoring records for the same primary product.

• CVE-2022-1388On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior KEV
  99Now
• CVE-2021-22986On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 KEV
  99Now
• CVE-2020-5902In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User InteKEV
  99Now
• CVE-2023-46747BIG-IP Configuration utility unauthenticated remote code execution vulnerabilityKEV
  98Now
• CVE-2021-22991On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3,KEV
  87Now
• CVE-2026-94127BIG-IP APM OAuth vulnerabilityKEV
  68This week

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.