CVE-2021-47755: Arbitrary File Access in Oliver Library Server

Successful exploitation of CVE-2021-47755 allows an attacker to bypass authentication and directly access any file the server has read permissions for. This could include configuration files containing database credentials, source code, or other sensitive data. The potential impact is significant, as an attacker could gain a deep understanding of the system's architecture and potentially escalate their access to compromise the entire network. The lack of authentication required for exploitation significantly broadens the attack surface, making it a high-priority concern for organizations running Oliver Library Server.

1. Reserved2026-01-10
2. Published2026-01-15
3. Modified2026-04-07
4. EPSS updated2026-03-23

The primary mitigation for CVE-2021-47755 is to upgrade Oliver Library Server to version 8.00.008.053 or later, which contains the fix. If an immediate upgrade is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious 'fileName' parameters. Specifically, look for requests with unusual characters or paths that attempt to access files outside of expected directories. Additionally, review file system permissions to ensure that sensitive files are not accessible by the web server user. After upgrade, confirm by attempting to access a known sensitive file via the FileServlet endpoint; access should be denied.