CVE-2022-51022
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal…
- Risk score
- 71/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.8%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- YiShaAdmin 2.2 through 3.1 has an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint, allowing attackers to read and delete arbitrary files. Attackers can send crafted GET requests to exploit this vulnerability.
- Affected
- {'products': ['YiShaAdmin'], 'packages': [], 'versions': ['2.2', '3.1']}
- Fix
- Check the linked advisory for the fix, as the specific commit that fixes the issue is mentioned.
- Exploitation
- Exploited in the wild
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
- https://github.com/liukuo362573/YiShaAdmin/commit/025b0628b1295bd2d9fd6c9b5b82692a345151ef
- https://github.com/liukuo362573/YiShaAdmin/commit/c3b66e66bf6d70a561190cd8da7f4df7b141931d
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/yishaadmin-lfi.yaml
- https://huntr.com/bounties/2acdd87a-12bd-4ce4-994b-0081eb908128
- https://www.vulncheck.com/advisories/yishaadmin-3.1-unauthenticated-path-traversal-via-downloadfile-endpoint
Original description
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Last activity 22 Oct 2026. Patch Forecast updates every hour.