CVE-2021-47978: ProcessMaker LFI Vulnerability

CVE-2021-47978 Overview

CVE-2021-47978 is a Local File Inclusion (LFI) vulnerability in ProcessMaker 3.5.4, a business process management (BPM) and workflow automation platform. The flaw stems from improper validation of user-supplied path parameters, allowing unauthenticated attackers to traverse the file system using directory traversal sequences. Successful exploitation enables reading of arbitrary files on the host, including sensitive system files such as /etc/passwd, without any authentication. The issue is classified under CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
Unauthenticated attackers can read arbitrary files from the ProcessMaker host, exposing credentials, configuration data, and operating system files.

Affected Products

ProcessMaker 3.5.4
ProcessMaker 3.x branch (refer to vendor advisories for exact range)
Deployments exposing the vulnerable web endpoint to local or networked users

Discovery Timeline

2026-05-16 - CVE-2021-47978 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2021-47978

Vulnerability Analysis

The vulnerability resides in a ProcessMaker 3.5.4 web endpoint that accepts a file path parameter without sufficient sanitization. An attacker supplies directory traversal sequences such as ../ chained multiple times to escape the intended directory. The application concatenates the attacker-controlled input into a file inclusion or read operation, then returns the file contents in the HTTP response. Because the endpoint does not require authentication, exploitation requires no valid session, credentials, or user interaction. The Exploit-DB entry EDB-50229 and the VulnCheck advisory document the affected request pattern and confirm reads of /etc/passwd on Linux deployments. EPSS data indicates a 0.034% probability of exploitation in the next 30 days at the time of publication.

Root Cause

The root cause is improper neutralization of path traversal sequences in a parameter used to construct a file path. The handler accepts characters such as . and / and resolves them against the underlying filesystem rather than restricting input to an allowlist of permitted resources. This is a classic CWE-98 pattern in PHP applications that pass user input to include or read primitives.

Attack Vector

An attacker sends a single crafted HTTP request to the vulnerable endpoint with directory traversal sequences embedded in the file parameter. The server resolves the path outside the intended web directory and returns the contents of the requested file. Targets typically include /etc/passwd, ProcessMaker configuration files, PHP source code containing database credentials, and SSH keys readable by the web server account. The technical mechanics are documented in the public proof-of-concept at Exploit-DB #50229.

Detection Methods for CVE-2021-47978

Indicators of Compromise

HTTP requests to ProcessMaker endpoints containing ../, ..%2f, or URL-encoded traversal sequences in query or path parameters
Web server access logs showing successful 200 responses to requests targeting filenames outside the application root
Unexpected reads of /etc/passwd, /etc/shadow, or ProcessMaker config files by the web server process
Outbound exfiltration of configuration files immediately after suspicious inbound requests

Detection Strategies

Inspect web access logs for traversal patterns and file paths referencing sensitive OS files
Deploy web application firewall (WAF) rules that block path traversal sequences on ProcessMaker request parameters
Enable file integrity monitoring (FIM) on ProcessMaker configuration and credential files to surface unauthorized reads
Correlate web request anomalies with downstream filesystem access on the application server

Monitoring Recommendations

Forward ProcessMaker and reverse proxy logs to a centralized analytics platform for traversal pattern detection
Alert on requests where parameter values contain repeated ../ sequences or absolute paths beginning with /etc/
Baseline normal ProcessMaker URI patterns and flag deviations involving file-read parameters
Review authentication telemetry for unauthenticated requests reaching sensitive endpoints

How to Mitigate CVE-2021-47978

Immediate Actions Required

Restrict network exposure of ProcessMaker 3.5.4 instances to trusted networks until upgraded
Audit web server logs for prior exploitation attempts containing path traversal patterns
Rotate credentials, API keys, and database passwords stored within ProcessMaker configuration files
Apply WAF rules that reject requests containing ../ or encoded equivalents on ProcessMaker endpoints

Patch Information

ProcessMaker users should upgrade beyond 3.5.4 to a fixed release of the ProcessMaker 3 line. Refer to the ProcessMaker homepage and the VulnCheck advisory for fixed version details and upgrade guidance. No vendor advisory URL is listed in the enriched NVD entry, so administrators should validate the fixed version directly with the vendor before scheduling the upgrade.

Workarounds

Place ProcessMaker behind a reverse proxy or WAF that strips or blocks path traversal characters in parameters
Run the ProcessMaker PHP process under a least-privilege account with no read access to /etc/shadow or unrelated application directories
Apply mandatory access controls (SELinux, AppArmor) to constrain the web server's readable filesystem scope
Disable or firewall-restrict the affected endpoint if it is not required for production workflows

bash

# Configuration example: block path traversal at an Nginx reverse proxy
location /processmaker/ {
    if ($request_uri ~* "(\.\./|\.\.%2ف|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://processmaker_backend;
}