CVE-2022-51022
YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint
- State
- Published
- Severity
- 8.8 High
- Published
- Oct 22, 2026
- Updated
- Oct 22, 2026
- Reserved
- Oct 14, 2026
Description
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
YiShaAdminliukuo362573 |
|
References
- huntr Reporttechnical-descriptionexploit
- Fix Commitpatch
- Incomplete Fixpatch
- Nuclei Templatetechnical-description
- VulnCheck Advisory: YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.