Known exploited · TIBCO

CVE-2018-18809: TIBCO JasperReports Library Directory Traversal Vulnerability

What it is

TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.

Added December 29, 2022Due January 19, 2023CISA KEV catalog 2026.10.01

Vendor: TIBCO
Product: JasperReports
Added to KEV: December 29, 2022
CISA due date: January 19, 2023
Ransomware use: Unknown
Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

What CISA requires

Apply updates per vendor instructions.

Find every instance of JasperReports you run, including the forgotten ones, and check its version against the vendor advisory.
Apply the vendor's fix or mitigation, before January 19, 2023 if you are bound by CISA's deadline, sooner if it faces the internet.
Assume it was tried against you already: look for signs of exploitation from the date it was added, not from the day you patched.
Until every instance is patched, block the attack at the edge: a WAF in blocking mode stops path traversal attempts.

The Dome

The Dome's WAF runs the OWASP Core Rule Set in blocking mode and stops path traversal attempts before they reach your application.

T Academy

Security engineering on real hosts in the browser, every objective checked on the machine. The first two lessons of Linux 1 are free.

Source: CISA Known Exploited Vulnerabilities Catalog (public domain), catalog version 2026.10.01.