{"id":"CVE-2022-51022","kind":"vulnerability","aliases":["CVE-2022-51022"],"related":[],"title":"YiShaAdmin: unauthenticated path traversal reads and deletes server files","description":"YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.","summary":"YiShaAdmin versions 2.2 through 3.1 let anyone send a crafted GET request to /admin/File/DownloadFile and traverse the filePath parameter. An attacker can read arbitrary files such as /etc/passwd and, with the delete parameter set, remove them.","severity":"critical","cvss":9.1,"epss":0.00794,"exploited":true,"exploited_at":null,"products":[{"name":"YiShaAdmin","fixed":["commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef"],"affected":">= 2.2, <= 3.1","ecosystem":"github"}],"ecosystems":["github"],"tags":["package","path-traversal","self-hosted","unauthenticated","yishaadmin"],"not_affected_if":["patched-commit-025b062","version-outside-2.2-3.1"],"how_to_check":"Check whether the deployed YiShaAdmin version is between 2.2 and 3.1 inclusive, or whether it predates commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef.","fix":"Update YiShaAdmin to a build that includes commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef or later.","status":"open","published_at":"2026-10-22T11:17:05+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:31+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:32:31Z","model":"claude-haiku-5-5","output":{"fix":"Update YiShaAdmin to a build that includes commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef or later.\nunknown","reach":"internet","title":"YiShaAdmin: unauthenticated path traversal reads and deletes server files","impact":"high","summary":"YiShaAdmin versions 2.2 through 3.1 let anyone send a crafted GET request to /admin/File/DownloadFile and traverse the filePath parameter. An attacker can read arbitrary files such as /etc/passwd and, with the delete parameter set, remove them.","category":"package","who_cares":["yishaadmin","self-hosted"],"confidence":0.85,"needs_auth":"no","worst_case":"Attacker reads secrets and deletes arbitrary server files without logging in","analyst_note":"Confirm the fixed release tag for commit 025b062 and whether the /admin/File/DownloadFile endpoint is exposed on default installs; see https://nvd.nist.gov/vuln/detail/CVE-2022-51022.","how_to_check":"Check whether the deployed YiShaAdmin version is between 2.2 and 3.1 inclusive, or whether it predates commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef.\nunknown","needs_analyst":true,"not_affected_if":["version-outside-2.2-3.1","patched-commit-025b062"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000574,"input_tokens":3087,"output_tokens":530,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed release tag containing commit 025b062 and whether the endpoint is exposed by default at https://nvd.nist.gov/vuln/detail/CVE-2022-51022.","search":"'-10':128C '-20':129C '-2022':11A,14A '-51022':12A,15A '/admin/file/downloadfile':39B,77C '/etc/passwd':53B '025b062':68C '2.2':28B,62C '2023':127C '3.1':30B,64C 'allow':80C 'anyon':32B 'arbitrari':49B,86C 'attack':46B,81C,92C 'commit':67C 'contain':69C 'craft':35B,95C 'cve':10A,13A 'delet':7A,57B,85C,107C 'directori':99C 'endpoint':78C 'etc/passwd':116C 'evid':118C 'exploit':117C 'file':9A,50B,87C,114C 'filepath':43B,90C,103C 'first':120C 'fix':65C 'foundat':125C 'get':36B,96C 'host':23B 'let':31B 'like':115C 'observ':121C 'packag':17B 'paramet':44B,58B,91C,108C 'path':3A,19B,72C 'path-travers':18B 'read':5A,48B,83C,110C 'remov':60B,112C 'request':37B,97C 'self':22B 'self-host':21B 'send':33B,94C 'sequenc':101C 'server':8A 'set':59B,105C 'shadowserv':124C 'system':113C 'travers':4A,20B,41B,73C,100C 'unauthent':2A,24B,71C 'version':27B 'via':88C 'vulner':74C 'yishaadmin':1A,16A,25B,26B,61C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2022-51022","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51022","severity":null,"published_at":"2026-10-22T11:17:05+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2022-51022:211","url":null,"severity":null,"published_at":"2026-10-23T22:23:02+00:00","modified_at":"2026-10-23T22:23:02+00:00","first_seen_at":"2026-10-23T22:23:02+00:00","fetched_at":"2026-10-23T22:23:02+00:00","note":"No release tag exists: repo has no GitHub releases; fix is only commit 025b062 (2022-02-10, FileHelper.cs +1 line). VulnCheck lists an 'Incomplete Fix' reference and puts it in its KEV, citing Shadowserver exploitation. Nuclei template public (PR 3708). Endpoint is unauthenticated in affected versions, so exposed by default. I did not read the diff."},{"source":"epss","external_id":"CVE-2022-51022","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-51022","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":1413,"url":"https://www.vulncheck.com/advisories/yishaadmin-3.1-unauthenticated-path-traversal-via-downloadfile-endpoint","title":"VulnCheck: YiShaAdmin 3.1 unauthenticated path traversal (KEV)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1415,"url":"https://github.com/liukuo362573/YiShaAdmin/commit/025b0628b1295bd2d9fd6c9b5b82692a345151ef","title":"Commit 025b062 Update FileHelper.cs (+1 -0)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1416,"url":"https://github.com/projectdiscovery/nuclei-templates/pull/3708","title":"nuclei-templates PR #3708: yishaadmin path traversal","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}