Live › vulnerability › CVE-2022-51025
Go to dashboardPenta Security WAPPLES 4.0.54.1, 5.0 and 6.0 let an authenticated user request files outside the intended folder through the name parameter of /webapi/file/transfer. A hardcoded account makes logging in effectively trivial, so an attacker can read files such as /etc/passwd.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Penta Security WAPPLES web application firewall in the affected version lines, especially with the management interface reachable from untrusted networks. Sources say exploitation was observed in the wild, so exposed appliances should be treated as a priority. Deployments on unaffected versions can skip it.
No product ranges from the sources yet.
4.0.54.1, 5.0 or 6.0 in its admin console or firmware details/webapi/file/transfer containing type=db_backup and ../ in the name parameterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
This page as .md · .json · in your agent: get_signal("CVE-2022-51025")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.