CVE-2021-38146

CVE-2021-38146 is a high-severity absolute path traversal vulnerability in the File Download API of Wipro Holmes Orchestrator 20.4.1. An unauthenticated remote attacker can exploit this flaw by manipulating the SearchString JSON field in POST data to download arbitrary files from the affected system, leading to a high impact on confidentiality. While there is no evidence of active exploitation or Metasploit modules, a Nuclei template exists, indicating potential for exploitation. Despite its high risk score, the vulnerability has garnered minimal community discussion or media coverage.