← Back

CVE-2026-47871

nvd nist
Published: Jul 18, 2026Modified: Aug 20, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: security@vmware.com (Secondary)

Description

VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

Affected (7)

Broadcom
1 product
Vmware Avi Load Balancer
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Broadcom
Vmware Avi Load Balancer
From 22.1.1 to 22.1.7
Vmware Avi Load Balancer
From 30.1.1 to 30.2.7
Vmware Avi Load Balancer
From 31.1.1 to 31.2.2
Vmware Avi Load Balancer
Version 31.2.2
Vmware Avi Load Balancer
Version 31.2.2 2p1
Vmware Avi Load Balancer
Version 31.2.2 2p2
Vmware Avi Load Balancer
Version 32.1.1

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.