CVE-2016-5312

Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before...

6.5 MediumPublic exploit

Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the sn parameter to brightmail/servlet/com.ve.kavachart.servlet.ChartStream.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

54.0%Up 44.1 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

Record: CVE-2016-5312
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-5312
Updated: 2026-11-02

EUVDEUVD-2016-6263 No score

Record: EUVD-2016-6263
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6r8q-pc85-r7wp 6.5

Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before...

Record: GHSA-6r8q-pc85-r7wp
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

Affected products

symantec messaging gateway

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Symantec Messaging Gateway 10.6.1 - Directory Traversal	2016-09-28

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-5312 is a medium vulnerability (CVSS 6.5) in Symantec Messaging Gateway, published April 14, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 54.0%, the 99th percentile. No source names a fixed version.