Skip to content
Threat Feed
Subscribe
high threat

YiShaAdmin: Unauthenticated path traversal (CVE-2022-51022)

YiShaAdmin versions 2.2 through 3.1 contain an unauthenticated path traversal vulnerability in the DownloadFile endpoint, allowing attackers to read or delete arbitrary files via manipulated parameters.

CVE search metadata

CVE search record: CVE-2022-51022. Severity: critical. CVSS: 9.1. KEV: no. Product: YiShaAdmin (2.2 through 3.1). Brief: YiShaAdmin: Unauthenticated path traversal (CVE-2022-51022). Brief link: https://feed.craftedsignal.io/briefs/2026-10-yishaadmin-path-traversal/

Triage facts

Revision 1
Applicability
YiShaAdmin (2.2 through 3.1)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
4 public sources
Freshness
Revision 1Oct 22, 14:00 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Very likely

YiShaAdmin versions 2.2 through 3.1 are vulnerable to unauthenticated path traversal via the /admin/File/DownloadFile endpoint. Attackers can leverage the 'filePath' and 'delete' parameters to read or remove arbitrary files on the underlying system. Exploitation in the wild has been observed since October 2023. This issue is resolved in commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef.

Impact

Successful exploitation allows unauthenticated remote attackers to access sensitive system files or cause service disruption by deleting arbitrary files.

Recommendation

  • Update YiShaAdmin to the latest version or apply the fix provided in commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef.
  • Implement a web application firewall (WAF) rule to inspect requests to /admin/File/DownloadFile for directory traversal sequences (e.g., ../, ..).
  • Deploy the provided Sigma rule to detect exploitation attempts targeting this endpoint.

Immediate actions

Patch YiShaAdmin to the version containing commit 025b062

IT Operations 48h

Mitigations

Implement WAF blocking for traversal sequences in /admin/File/DownloadFile

immediate SOC

CVE-2022-51022

Detection coverage 1

Detect CVE-2022-51022 Exploitation - Path Traversal in YiShaAdmin

high

Detects unauthenticated GET requests to the DownloadFile endpoint containing directory traversal sequences, characteristic of CVE-2022-51022 exploitation.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →