{"id":"CVE-2022-51025","kind":"vulnerability","aliases":["CVE-2022-51025"],"related":[],"title":"Penta WAPPLES web firewall: path traversal lets attackers download arbitrary server files","description":"Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","summary":"Penta Security WAPPLES 4.0.54.1, 5.0 and 6.0 let an authenticated user request files outside the intended folder through the name parameter of /webapi/file/transfer. A hardcoded account makes logging in effectively trivial, so an attacker can read files such as /etc/passwd.","severity":"high","cvss":7.1,"epss":0.00373,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","penta-security","self-hosted","waf","wapples"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check whether the WAPPLES appliance runs version `4.0.54.1`, `5.0` or `6.0` in its admin console or firmware details\n- Review web logs for GET requests to `/webapi/file/transfer` containing `type=db_backup` and `../` in the name parameter","fix":"- Upgrade WAPPLES to a fixed release from Penta Security (unknown which version the sources name)\n- Restrict access to the WAPPLES management interface until patched","status":"open","published_at":"2026-10-22T11:17:05+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:31:40+00:00","updated_at":"2026-10-25T03:31:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:31:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade WAPPLES to a fixed release from Penta Security (unknown which version the sources name)\n- Restrict access to the WAPPLES management interface until patched","reach":"network","title":"Penta WAPPLES web firewall: path traversal lets attackers download arbitrary server files","impact":"high","summary":"Penta Security WAPPLES 4.0.54.1, 5.0 and 6.0 let an authenticated user request files outside the intended folder through the name parameter of /webapi/file/transfer. A hardcoded account makes logging in effectively trivial, so an attacker can read files such as /etc/passwd.","category":"infrastructure","nicknames":[],"who_cares":["penta-security","wapples","waf","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads arbitrary server files, including credentials and configuration.","analyst_note":"Sources say exploitation was first seen by Shadowserver on 2023-10-19 but the exploited-in-the-wild flag is no; confirm the status and find the vendor fixed version and advisory.","how_to_check":"- Check whether the WAPPLES appliance runs version `4.0.54.1`, `5.0` or `6.0` in its admin console or firmware details\n- Review web logs for GET requests to `/webapi/file/transfer` containing `type=db_backup` and `../` in the name parameter","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Teams running Penta Security WAPPLES web application firewall in the affected version lines, especially with the management interface reachable from untrusted networks. Sources say exploitation was observed in the wild, so exposed appliances should be treated as a priority. Deployments on unaffected versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":3443,"output_tokens":652,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-10':132C '-19':133C '-2022':14A,17A '-51025':15A,18A '/etc/passwd':67B,111C '/webapi/file/transfer':50B,93C '2023':131C '4.0.54.1':31B,71C '5.0':32B,72C '6.0':34B,74C 'account':53B,116C 'allow':81C 'arbitrari':10A,86C 'attack':8A,61B,83C,94C 'authent':37B,82C,118C 'backup':102C 'contain':75C 'cve':13A,16A 'db':101C 'download':9A,85C 'effect':57B,119C 'evid':122C 'exploit':121C 'file':12A,40B,64B,87C,109C 'firewal':4A 'first':124C 'folder':44B 'foundat':129C 'get':97C 'hardcod':52B,114C 'host':25B 'infrastructur':19B 'intend':43B 'let':7A,35B 'like':110C 'log':55B 'make':54B,117C 'name':47B,90C,106C 'observ':125C 'outsid':41B 'paramet':48B,91C 'path':5A,77C 'penta':1A,21B,28B,68C 'penta-secur':20B 'read':63B,108C 'request':39B,98C 'secur':22B,29B,69C 'self':24B 'self-host':23B 'send':96C 'sequenc':104C 'server':11A 'shadowserv':128C 'systemi':115C 'travers':6A,78C 'trivial':58B,120C 'type':100C 'user':38B 'via':88C 'vulner':79C 'waf':26B 'wappl':2A,27B,30B,70C 'web':3A","nicknames":[],"mitigations":[],"who_affected":"Teams running Penta Security WAPPLES web application firewall in the affected version lines, especially with the management interface reachable from untrusted networks. Sources say exploitation was observed in the wild, so exposed appliances should be treated as a priority. Deployments on unaffected versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2022-51025","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51025","severity":null,"published_at":"2026-10-22T11:17:05+00:00","modified_at":"2026-10-23T22:16:51+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2022-51025","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-51025","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}