CVE-2012-4680

CVE-2012-4680 describes a directory traversal vulnerability in the XML Server component of IOServer versions prior to 1.0.19.0. This flaw allows remote attackers to read arbitrary files or list directories by manipulating URIs with “..” sequences, provided the Root Directory pathname lacks a trailing backslash. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity leading to partial confidentiality impact. While not listed in CISA’s KEV catalog, an exploit for IOServer 1.0.18.0 is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.