CVE-2016-8752
Path Traversal in Apache Atlas
CVE-2016-8752 is a high vulnerability (CVSS 7.5) in Apache Atlas, published August 29, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 81st percentile. Fixed in org.apache.atlas:atlas-common 0.8-incubating.
Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.
- Record
CVE-2016-8752- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.
- Record
CVE-2016-8752- Updated
- 2026-11-02
EUVDEUVD-2017-0005 No score
Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.
- Record
EUVD-2017-0005- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m2rr-h6g4-9cm9
Path Traversal in Apache Atlas
Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.
- Record
GHSA-m2rr-h6g4-9cm9- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22, CWE-284
- Updated
- 2026-11-02
OSV
Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.
- Record
CVE-2016-8752- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-m2rr-h6g4-9cm9
Path Traversal in Apache Atlas
Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.
- Record
GHSA-m2rr-h6g4-9cm9- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22, CWE-284
- Updated
- 2026-11-02
OSVPYSEC-2017-105
Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.
- Record
PYSEC-2017-105- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.atlas:atlas-commonMaven |
0.6.0-incubating up to 0.8-incubating | 0.8-incubating |
org.apache.atlas:atlas-commonMaven |
0.6.0-incubating up to 0.8-incubating, plus listed versions 0.6-incubating0.7-incubating0.7.1-incubating |
0.8-incubating |
apache-atlasPyPI |
All versions, plus listed versions 0.0.10.0.110.0.120.0.130.0.14 Show 6 moreShow less0.0.20.0.30.0.40.0.50.0.150.0.16 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.apache.org/thread.html/f7435d66b840daa2a38ad1329d639b70f5a9476e7580ae885d422e86%40%3Cdev.atlas.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2016-8752
github.com/pypa/advisory-database/tree/main/vulns/apache-atlas/PYSEC-2017-105.yaml