Path Traversal in HAVELSAN Inc. Liman MYS

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: before 2.3.5-1132.

• HAVELSAN Inc. Liman MYS: affected at version 0 and at versions less than 2.3.5-1132 under semver.
• The record marks the product default status as unaffected and separately declares the range above as affected. It does not establish the status of later or parallel release branches beyond that declaration.

This is a CWE-22 weakness in which an attacker-controlled pathname is not adequately constrained to the permitted directory. The record establishes network reachability, low attack complexity, low privileges required, and no user interaction, but it does not identify the endpoint, parameter, component, encoding, or path canonicalization behavior involved. If the vulnerable path operation resolves outside its intended root, an attacker may access files beyond the restricted directory, subject to the service account's permissions. The exact read or write behavior, and whether other path-handling operations are affected, remain unknown.

The recorded reachability is network-based. Exploitation requires low privileges, does not require user interaction, and has low complexity. The record does not establish that the flaw has been exploited, does not provide a public-exploit status, and does not identify an active campaign; these statuses are unknown rather than negative. Exploitation would still depend on access to the affected Liman MYS service and on the permissions available to the vulnerable file operation.

The primary technical consequence is possible disclosure of data through pathname resolution outside the restricted directory. Exploitation requires low privileges but no user interaction, and the recorded scope is unchanged. The extent of disclosure depends on the vulnerable endpoint, the service account's permissions, and the files accessible to that account. The record does not establish modification of data, privilege escalation, or loss of availability.

Successful exploitation could disclose files that the application intended to keep within a restricted directory. The recorded confidentiality impact is high, so configuration, operational, or other sensitive data could be exposed if it is readable by the service account. The record does not identify which file types are reachable. No integrity or availability impact is recorded in the supplied assessment, so modification of data or service disruption should not be assumed.

1. Upgrade affected deployments to 2.3.5-1132, the recorded boundary excluded by the less-than affected condition. Do not infer the status of later or parallel release branches that are not verified by the record.
2. If an upgrade cannot be completed immediately, apply an environment-specific temporary control that limits access to the Liman MYS service to trusted users and networks. This is a precautionary exposure-reduction measure, not a vendor-confirmed workaround.
3. After the change, verify the deployed release and review the service account's read permissions for sensitive directories.

• Inventory systems running HAVELSAN Inc. Liman MYS and compare deployed releases with the affected range in the record.
• Identify deployments reachable over the network by low-privilege accounts.
• Check the service account's permissions on sensitive directories and files that the application can access.
• Review application and file-access audit logs for anomalous requests containing traversal sequences or paths outside the expected directory. This is precautionary monitoring; the record provides no specific IOC or named log event.
• Do not treat the absence of matching log evidence as proof that a system is safe.