{"id":"CVE-2022-46178","summary":"Path Traversal In MeterSpere allows file upload to any path","details":"MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability has been fixed in v2.5.1. There are no workarounds.","aliases":["GHSA-9p62-x3c5-hr5p"],"modified":"2026-08-12T13:01:02.448067Z","published":"2022-12-29T18:09:38.842Z","database_specific":{"cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46178.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46178.json"},{"type":"ADVISORY","url":"https://github.com/metersphere/metersphere/security/advisories/GHSA-9p62-x3c5-hr5p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46178"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/metersphere/metersphere","events":[{"introduced":"0"},{"fixed":"8e5455a00c54e5efd5d01de55258e548702583f5"}],"database_specific":{"cpe":"cpe:2.3:a:metersphere:metersphere:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"v2.5.1"},{"fixed":"2.5.1"}],"source":["AFFECTED_FIELD","CPE_RANGE"]}}],"versions":["v2.5.0","v1.2.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-46178.json","vanir_signatures_modified":"2026-08-12T13:01:02Z","vanir_signatures":[{"digest":{"function_hash":"68593591742400051668706482424047994328","length":3546},"id":"CVE-2022-46178-636f3596","signature_type":"Function","signature_version":"v1","source":"https://github.com/metersphere/metersphere/commit/8e5455a00c54e5efd5d01de55258e548702583f5","target":{"file":"api-test/backend/src/main/java/io/metersphere/api/dto/definition/request/MsScenario.java","function":"toHashTree"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["322932455839097205091892292438140062018","151060018808302580421457518745355805453","284541459468125324867198926681464239690","178769566840486555860437685373154167721"],"threshold":0.9},"id":"CVE-2022-46178-b8f8d860","signature_type":"Line","signature_version":"v1","source":"https://github.com/metersphere/metersphere/commit/8e5455a00c54e5efd5d01de55258e548702583f5","target":{"file":"api-test/backend/src/main/java/io/metersphere/api/dto/definition/request/MsScenario.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"}]}