{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/yishaadmin-2.2-through-3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yishaadmin:yishaadmin:2.2:*:*:*:*:*:*:*","cpe:2.3:a:yishaadmin:yishaadmin:3.1:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2022-51022"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["YiShaAdmin (2.2 through 3.1)"],"_cs_severities":["high"],"_cs_tags":["cve-2022-51022","path-traversal","web-vulnerability"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eYiShaAdmin versions 2.2 through 3.1 are vulnerable to unauthenticated path traversal via the /admin/File/DownloadFile endpoint. Attackers can leverage the 'filePath' and 'delete' parameters to read or remove arbitrary files on the underlying system. Exploitation in the wild has been observed since October 2023. This issue is resolved in commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to access sensitive system files or cause service disruption by deleting arbitrary files.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate YiShaAdmin to the latest version or apply the fix provided in commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef.\u003c/li\u003e\n\u003cli\u003eImplement a web application firewall (WAF) rule to inspect requests to /admin/File/DownloadFile for directory traversal sequences (e.g., ../, ..).\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect exploitation attempts targeting this endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T14:00:01Z","date_published":"2026-10-22T14:00:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-yishaadmin-path-traversal/","summary":"YiShaAdmin versions 2.2 through 3.1 contain an unauthenticated path traversal vulnerability in the DownloadFile endpoint, allowing attackers to read or delete arbitrary files via manipulated parameters.","title":"YiShaAdmin: Unauthenticated path traversal (CVE-2022-51022)","url":"https://feed.craftedsignal.io/briefs/2026-10-yishaadmin-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - YiShaAdmin (2.2 Through 3.1)","version":"https://jsonfeed.org/version/1.1"}