CVE-2026-78602: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Elastic Elastic Maps Server

CVE-2026-78602 is an improper limitation of a pathname to a restricted directory (CWE-22) vulnerability in Elastic Maps Server. An unauthenticated attacker who can access the service over the network may exploit this flaw to perform path traversal (CAPEC-126), causing the server to disclose contents of files outside its designated content directory. The vulnerability does not require privileges or user interaction and impacts confidentiality but not integrity or availability.

The vulnerability allows an unauthenticated remote attacker to read arbitrary files accessible by the Elastic Maps Server process outside the intended content directory. This results in information disclosure but does not affect system integrity or availability. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor Elastic's advisories for updates and apply patches once available. Until then, restricting network access to the Elastic Maps Server and limiting file permissions may reduce exposure.