{"id":"CVE-2022-45866","details":"qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other products, allows directory traversal via ../ in a .qp file.","modified":"2026-08-12T13:32:19.113219Z","published":"2022-11-23T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45866.json","unresolved_ranges":[{"extracted_events":[{"fixed":"11.3"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"https://github.com/PierreLvx/qpress/compare/20170415...20220819"},{"type":"WEB","url":"https://pkgs.org/download/qpress"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45866.json"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQWF7635AJSDKEIGLB73XAH643POGTFY/"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4RXO3VYIFRTNIFHWIAZWND6ZXQ5OYOB/"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUZ73XT2FXLHC7I4ODLOVB4O4QN7Q7JB/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45866"},{"type":"FIX","url":"https://github.com/EvgeniyPatlan/qpress/commit/ddb312090ebd5794e81bc6fb1dfb4e79eda48761"},{"type":"FIX","url":"https://github.com/PierreLvx/qpress/pull/6"},{"type":"FIX","url":"https://github.com/percona/percona-xtrabackup/pull/1366"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/evgeniypatlan/qpress","events":[{"introduced":"0"},{"fixed":"ddb312090ebd5794e81bc6fb1dfb4e79eda48761"}],"database_specific":{"source":"REFERENCES"}}],"versions":["20170415","20170413"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-45866.json","vanir_signatures_modified":"2026-08-12T13:32:19Z","vanir_signatures":[{"source":"https://github.com/evgeniypatlan/qpress/commit/ddb312090ebd5794e81bc6fb1dfb4e79eda48761","target":{"file":"qpress.cpp"},"deprecated":false,"digest":{"line_hashes":["165681341996903462382724804317537371231","280950552592433508324645601613569106410","152425926461195821601733002185298632827","210649292688485667024453137963382803765","311984534777797894338883491476150618523","40474840347025451484466463127201989643","315094204636216702504697816662283079421","136576270636418745687106323022523000422","259933354616104424474613010318560943121","20399720491762195306154615047507393337","306942522876876289161269677097104108153","323169110135014150324121626149160976463","304755878154402647412962449438102229938","214881406235150846864073536995441500590","62040950797057498489736362735711511245","153719876602935340839125189136890419460","233177848015367538166113230183660859032","176594758305448876557826261108469078314"],"threshold":0.9},"id":"CVE-2022-45866-309e3628","signature_type":"Line","signature_version":"v1"},{"target":{"file":"qpress.cpp","function":"decompress_directory"},"deprecated":false,"digest":{"function_hash":"124084074116828457641346450803559922119","length":1064},"id":"CVE-2022-45866-34fd4606","signature_type":"Function","signature_version":"v1","source":"https://github.com/evgeniypatlan/qpress/commit/ddb312090ebd5794e81bc6fb1dfb4e79eda48761"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}