CVE-2026-78602: Elastic Maps Server Path Traversal Flaw

CVE-2026-78602 Overview

CVE-2026-78602 is a path traversal vulnerability [CWE-22] in Elastic Maps Server. An unauthenticated attacker with network access to the service can craft requests that resolve outside the intended content directory. The server then returns the contents of arbitrary files readable by the service process. The flaw is classified as an information disclosure issue and requires no authentication or user interaction. Elastic addressed the issue in the security update tracked as ESA-2026-148, which covers Elastic Maps Server versions 8.19.19, 9.4.4, and 9.5.1.

Critical Impact
Unauthenticated network attackers can read files outside the Elastic Maps Server content directory, exposing configuration data, credentials, or map assets accessible to the server process.

Affected Products

Elastic Maps Server versions prior to 8.19.19
Elastic Maps Server versions prior to 9.4.4
Elastic Maps Server versions prior to 9.5.1

Discovery Timeline

2026-09-02 - CVE-2026-78602 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-78602

Vulnerability Analysis

CVE-2026-78602 is an Improper Limitation of a Pathname to a Restricted Directory issue, mapped to [CWE-22] and aligned with attack pattern CAPEC-126. Elastic Maps Server serves tile and map asset content from a designated content directory. The vulnerable request handler does not adequately normalize or validate path components supplied by clients. As a result, sequences that traverse the directory hierarchy resolve to file paths outside the intended root. The server returns any file readable by its process account, producing an information disclosure primitive.

The attack is limited to confidentiality impact. Integrity and availability are not affected because the flaw only enables read access to files the service can already open.

Root Cause

The root cause is missing or insufficient canonicalization of user-controlled path segments before they are joined to the content directory root. Traversal sequences supplied in HTTP request paths bypass the intended containment boundary and reach the underlying filesystem read operation.

Attack Vector

Exploitation requires only network reachability to the Elastic Maps Server HTTP endpoint. An attacker issues a crafted request whose path resolves outside the map content directory. No credentials or user interaction are required. Targets of interest include service configuration files, environment files, private keys, and any other content accessible under the service process identity. Refer to the Elastic Security Update ESA-2026-148 for vendor details.

Detection Methods for CVE-2026-78602

Indicators of Compromise

HTTP requests to Elastic Maps Server containing traversal sequences such as ../, ..%2f, or ..%5c in the URL path.
Access log entries showing successful responses for paths that resolve outside the configured maps content directory.
Unexpected reads of sensitive files such as /etc/passwd, application configuration files, or private key material by the Elastic Maps Server process.

Detection Strategies

Deploy web application firewall or reverse proxy rules that flag encoded and unencoded path traversal patterns against Maps Server URIs.
Correlate Elastic Maps Server access logs with file access telemetry on the host to identify reads outside the expected content directory.
Alert on HTTP 200 responses that return non-map MIME types or file sizes inconsistent with tile assets.

Monitoring Recommendations

Enable verbose HTTP access logging on Elastic Maps Server and forward logs to a centralized analytics platform.
Monitor the service account for anomalous file open operations on paths outside the maps content root.
Track outbound data volumes from the Maps Server host for spikes that suggest bulk file extraction.

How to Mitigate CVE-2026-78602

Immediate Actions Required

Upgrade Elastic Maps Server to version 8.19.19, 9.4.4, or 9.5.1 as documented in ESA-2026-148.
Restrict network exposure of the Maps Server to trusted clients and internal networks until patching is complete.
Audit the service account permissions and remove read access to any sensitive files not required for map delivery.

Patch Information

Elastic released fixed versions 8.19.19, 9.4.4, and 9.5.1 in the security update ESA-2026-148. Administrators should apply the update on the branch matching their deployment.

Workarounds

Place Elastic Maps Server behind a reverse proxy that normalizes URI paths and rejects traversal sequences before forwarding requests.
Run the Maps Server process under a dedicated low-privilege account with filesystem access scoped to the content directory.
Apply network access controls so only authorized Kibana instances and internal clients can reach the Maps Server endpoint.

bash

# Example NGINX reverse proxy hardening for Elastic Maps Server
location /maps/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|\.\.%5c)") {
        return 400;
    }
    proxy_pass http://elastic-maps-server:8080/;
}