CVE-2021-47864

HIGH

OSAS Traverse Extension 11 - Path Traversal

Title source: llm

Description

OSAS Traverse Extension 11 contains an unquoted service path vulnerability in the TravExtensionHostSvc service running with LocalSystem privileges. Attackers can exploit the unquoted path to inject and execute malicious code by placing executable files in the service's path, potentially gaining elevated system access.

Exploits (1)

exploitdb WRITEUP

by Johnny Tech · textlocalwindows

https://www.exploit-db.com/exploits/49698

View Code ZIP pw:eip

References (3)

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/49698

[Various Sources] https://web.archive.org/web/20200817150522/https://www.osas.com/

[Third Party Advisory] https://www.vulncheck.com/advisories/osas-traverse-extension-travextensionhostsvc-unquoted-service-path

Scores

CVSS v3 7.8

EPSS 0.0002

EPSS Percentile 4.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-428

Status published

Products (1)

OSAS/OSAS Traverse Extension 11 x86

Published Jan 21, 2026

Tracked Since Feb 18, 2026