Path Traversal in HAVELSAN Inc. Liman MYS

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: from 2.3.2 before 2.3.4-1124.

• HAVELSAN Inc. Liman MYS: affected from 2.3.2 before 2.3.4-1124, using the supplied semver version definition.
• The documented remediation boundary is 2.3.4-1124.
• The status of parallel release branches or versions outside the stated range is not established by the record.

HAVELSAN Inc. Liman MYS has a CWE-22 Path Traversal weakness in which a user-controlled pathname is not properly confined to the intended restricted directory. The supplied attack characteristics indicate that the flaw is reachable over the network, requires no authentication, and does not require user interaction. If successfully exploited, it may allow an attacker to read files accessible to the application outside the intended directory, depending on process permissions and deployment configuration. The record does not identify the endpoint, pathname parameter, internal component, or precise validation logic that fails.

The flaw is reachable over the network, and the supplied attack characteristics describe low complexity, no required privileges, and no required user interaction.

The supplied record does not mark the vulnerability as known exploited, does not identify a ransomware campaign, and sets the public exploit field to false. No exploit code, indicators, or confirmed abuse cases are documented in the supplied material. This limited evidence does not prove that exploitation has never occurred.

Successful exploitation could cross the intended directory boundary and disclose files that the application can read. The organisational consequence could include exposure of configuration information or internal data, depending on file contents and process permissions. The record does not support claims of file modification, code execution, privilege escalation, or service disruption. The stated scope is unchanged, so the described consequence remains within the affected component.

The primary consequence is possible unauthorized access to files outside the directory that the application is intended to serve, depending on process permissions and deployment configuration. This could expose configuration data, operational information, or other sensitive content if those files are readable by the application. The supplied impact characteristics support a confidentiality concern but do not support an integrity or availability consequence. No confirmed breach, victim, or exposed dataset is identified.

1. Upgrade HAVELSAN Inc. Liman MYS to 2.3.4-1124, the remediation boundary directly supported by the supplied affected-version data. Do not infer that every later or parallel release branch has been independently verified as unaffected.
2. Inventory and prioritize systems running from 2.3.2 through versions before 2.3.4-1124, especially deployments reachable over the network.
3. The record provides no specific workaround. Until the update can be applied, consider reducing network access to Liman MYS interfaces to trusted administrative networks as a precaution, while monitoring for anomalous requests.
4. After updating, verify the installed version on each deployment and review relevant access logs. The absence of suspicious requests does not rule out earlier exploitation.

1. Inventory all hosts and versions running HAVELSAN Inc. Liman MYS, prioritizing deployments reachable over the network.
2. Identify versions starting at 2.3.2 and before 2.3.4-1124; this is the affected range confirmed by the record.
3. Review web or application logs for anomalous requests that appear to attempt traversal outside the intended directory. Treat this as precautionary monitoring, not as a confirmed indicator for this vulnerability.
4. Compare each installation with the 2.3.4-1124 remediation boundary and record systems that cannot yet be updated.
5. Do not treat the absence of suspicious log entries as proof of safety, because the record provides no endpoint, log pattern, or specific IOC.