CVE-2020-37041
Published: 30 January 2026
Summary
CVE-2020-37041 is a high-severity Path Traversal (CWE-22) vulnerability in Citeum Opencti. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-22 (Publicly Accessible Content).
Deeper analysis
CVE-2020-37041 is a directory traversal vulnerability in OpenCTI version 3.3.1, specifically affecting the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests containing path traversal sequences such as '../' in the URL. For example, a request to /static/css//../../../../../../../../etc/passwd returns the contents of /etc/passwd. The vulnerability, discovered by Raif Berkay Dincel, was confirmed on Linux Mint and Windows 10, with a CVSS score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and mapped to CWE-22.
An unauthenticated attacker can exploit this vulnerability remotely with low attack complexity, no privileges, and no user interaction required. Successful exploitation grants high confidentiality impact by allowing access to sensitive files on the server, such as configuration files or password lists, while causing no integrity or availability disruption.
Advisories and related resources, including the OpenCTI GitHub repository (https://github.com/OpenCTI-Platform/opencti), an Exploit-DB entry (https://www.exploit-db.com/exploits/48595), the OpenCTI website (https://www.opencti.io/), and a Vulncheck advisory (https://www.vulncheck.com/advisories/opencti-directory-traversal), provide further details on patches and mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30937
Vulnerability details
OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with path traversal sequences (e.g., '../') in the URL. For example, requesting…
more
/static/css//../../../../../../../../etc/passwd returns the contents of /etc/passwd. This vulnerability was discovered by Raif Berkay Dincel and confirmed on Linux Mint and Windows 10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directory traversal in public web endpoint enables remote unauthenticated file read from local system (e.g. /etc/passwd).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates directory traversal by requiring effective input validation on URL entry points to reject path traversal sequences like '../'.
Requires design and maintenance of publicly accessible endpoints like static/css to protect against unauthorized access to non-public filesystem content.
Enforces application-level access controls to restrict file reads to authorized paths only, blocking traversal to arbitrary sensitive files.