---
id: "CVE-2022-51022"
kind: "vulnerability"
aliases: ["CVE-2022-51022"]
title: "YiShaAdmin: unauthenticated path traversal reads and deletes server files"
severity: "critical"
cvss: 9.1
epss: 0.00794
exploited: true
status: "open"
category: "package"
products: [{"name": "YiShaAdmin", "fixed": ["commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef"], "affected": ">= 2.2, <= 3.1", "ecosystem": "github"}]
ecosystems: ["github"]
tags: ["package", "path-traversal", "self-hosted", "unauthenticated", "yishaadmin"]
not_affected_if: ["patched-commit-025b062", "version-outside-2.2-3.1"]
published_at: "2026-10-22T11:17:05+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-51022", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:23:02+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-51022", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# YiShaAdmin: unauthenticated path traversal reads and deletes server files

YiShaAdmin versions 2.2 through 3.1 let anyone send a crafted GET request to /admin/File/DownloadFile and traverse the filePath parameter. An attacker can read arbitrary files such as /etc/passwd and, with the delete parameter set, remove them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:YiShaAdmin affected >= 2.2, <= 3.1 fixed commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef

## How to check

Check whether the deployed YiShaAdmin version is between 2.2 and 3.1 inclusive, or whether it predates commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef.

## Fix

Update YiShaAdmin to a build that includes commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef or later.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-51022
- 2026-10-23T22:23:02+00:00 analyst — No release tag exists: repo has no GitHub releases; fix is only commit 025b062 (2022-02-10, FileHelper.cs +1 line). VulnCheck lists an 'Incomplete Fix' reference and puts it in its KEV, citing Shadowserver exploitation. Nuclei template public (PR 3708). Endpoint is unauthenticated in affected versions, so exposed by default. I did not read the diff.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-51022

## Documents

- [advisory] VulnCheck: YiShaAdmin 3.1 unauthenticated path traversal (KEV) https://www.vulncheck.com/advisories/yishaadmin-3.1-unauthenticated-path-traversal-via-downloadfile-endpoint
- [fix] Commit 025b062 Update FileHelper.cs (+1 -0) https://github.com/liukuo362573/YiShaAdmin/commit/025b0628b1295bd2d9fd6c9b5b82692a345151ef
- [poc] nuclei-templates PR #3708: yishaadmin path traversal https://github.com/projectdiscovery/nuclei-templates/pull/3708

## From the sources

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_