CVE-2026-47871
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Directory traversal vulnerability in VMware Avi Load Balancer. An authenticated network user can perform directory traversal attacks.
Risk Assessment
May allow unauthorized access to files outside the intended directory, potentially leading to data disclosure.
Recommendation
Upgrade to the fixed versions mentioned in the description (e.g., 32.1.2, 31.2.2-2p3, 30.2.7).
Other vulnerabilities in VMware Avi Load Balancer
See all- CVE-2026-47865Critical
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access can access the Avi Control plane without authentication.
- CVE-2026-47870High
Vulnerability in VMware Avi Load Balancer allowing privilege escalation. A malicious authenticated user with network access can execute remote code.
- CVE-2026-47869High
VMware Avi Load Balancer contains a remote code execution vulnerability. An authenticated attacker with network access can inject and execute code.
- CVE-2026-47868High
Vulnerability in VMware Avi Load Balancer allows a local user to escalate privileges to root. An attacker with local access can exploit this flaw to run code with administrator privileges.
- CVE-2026-47867High
VMware Avi Load Balancer contains a remote code execution vulnerability. An unauthenticated attacker with network access can access the Avi Control plane and execute code remotely.
- CVE-2026-47866High
VMware Avi Load Balancer has an authorization bypass vulnerability. An attacker on the network can access a limited subset of the Avi Control Plane without proper authorization. Multiple versions affected, patches available.
Original NVD description (English source)
VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)