---
id: "CVE-2022-51025"
kind: "vulnerability"
aliases: ["CVE-2022-51025"]
title: "Penta WAPPLES web firewall: path traversal lets attackers download arbitrary server files"
severity: "high"
cvss: 7.1
epss: 0.00373
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "penta-security", "self-hosted", "waf", "wapples"]
not_affected_if: ["unaffected-version"]
published_at: "2026-10-22T11:17:05+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:31:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-51025", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-51025", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Penta WAPPLES web firewall: path traversal lets attackers download arbitrary server files

Penta Security WAPPLES 4.0.54.1, 5.0 and 6.0 let an authenticated user request files outside the intended folder through the name parameter of /webapi/file/transfer. A hardcoded account makes logging in effectively trivial, so an attacker can read files such as /etc/passwd.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the WAPPLES appliance runs version `4.0.54.1`, `5.0` or `6.0` in its admin console or firmware details
- Review web logs for GET requests to `/webapi/file/transfer` containing `type=db_backup` and `../` in the name parameter

## Fix

- Upgrade WAPPLES to a fixed release from Penta Security (unknown which version the sources name)
- Restrict access to the WAPPLES management interface until patched

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-51025
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-51025

## From the sources

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_