Cpe:2.3:a:yishaadmin:yishaadmin:3.1:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ayishaadminyishaadmin3.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 14:00:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgYiShaAdmin: Unauthenticated path traversal (CVE-2022-51022)https://feed.craftedsignal.io/briefs/2026-10-yishaadmin-path-traversal/Thu, 22 Oct 2026 14:00:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-yishaadmin-path-traversal/YiShaAdmin versions 2.2 through 3.1 contain an unauthenticated path traversal vulnerability in the DownloadFile endpoint, allowing attackers to read or delete arbitrary files via manipulated parameters.YiShaAdmin versions 2.2 through 3.1 are vulnerable to unauthenticated path traversal via the /admin/File/DownloadFile endpoint. Attackers can leverage the 'filePath' and 'delete' parameters to read or remove arbitrary files on the underlying system. Exploitation in the wild has been observed since October 2023. This issue is resolved in commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef.

Impact

Successful exploitation allows unauthenticated remote attackers to access sensitive system files or cause service disruption by deleting arbitrary files.

Recommendation

  • Update YiShaAdmin to the latest version or apply the fix provided in commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef.
  • Implement a web application firewall (WAF) rule to inspect requests to /admin/File/DownloadFile for directory traversal sequences (e.g., ../, ..).
  • Deploy the provided Sigma rule to detect exploitation attempts targeting this endpoint.
]]>highthreatcve-2022-51022path-traversalweb-vulnerability