CVE-2022-27248: Idearespa Reftree

Medium severity, CVSS 6.5. EPSS: 2.9% chance of exploitation in the next 30 days.

A directory traversal vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to download arbitrary .dwg files from a remote server by specifying an absolute or relative path when invoking the affected DownloadDwg endpoint. An attack uses the path field to CaddemServiceJS/CaddemService.svc/rest/DownloadDwg.

Affected products

• Idearespa Reftree: before 2021.09.17 (fixed in 2021.09.17)

Published 2022-04-03. Last modified 2026-06-17.