Live › vulnerability › CVE-2022-36537
Go to dashboardThe ZK Framework's AuUploader servlet has an unspecified flaw that lets an attacker read files from the web application's context. It is on CISA's known-exploited list, and ransomware use is reported in the tags.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ZK Framework AuUploader | vendor | – | – |
| zkoss zk framework | vendor | < 8.6.4.2 | 8.6.4.2 |
| zkoss zk framework | vendor | >= 9.0.0, < 9.0.1.3 | 9.0.1.3 |
| zkoss zk framework | vendor | >= 9.5.0, < 9.5.1.3 | 9.5.1.3 |
| zkoss zk framework | vendor | >= 9.6.0, < 9.6.2 | 9.6.2 |
Check whether your Java app depends on org.zkoss:zk and whether any ZK AuUploader servlet is deployed, for example in WEB-INF/web.xml or the app's lib directory.
Apply the vendor update per CISA guidance; the sources do not give a fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2022-36537")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.