{"id":"CVE-2022-51025","summary":"Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer","details":"Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","modified":"2026-10-23T02:45:21.036757518Z","published":"2026-10-22T10:57:35.298Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"4.0.54.1"},{"last_affected":"4.0.54.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"}]}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51025.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51025.json"},{"type":"ARTICLE","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/wapples-firewall-lfi.yaml"},{"type":"EVIDENCE","url":"https://medium.com/@_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51025"},{"type":"WEB","url":"https://www.pentasecurity.com/product/wapples/"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/penta-security-wapples-4.0.54.1-5.0-6.0-path-traversal-via-webapi-file-transfer"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/projectdiscovery/nuclei-templates","events":[{"introduced":"c552e09df5c47a9875deca69d0b8871649e3480e"},{"last_affected":"ddb9a608ffa9b2a109aa799a02dce9f38d497efd"}],"database_specific":{"extracted_events":[{"strategy":"StandaloneSingleVersion","range":[{"introduced":"5.0"},{"last_affected":"5.0"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"6.0"},{"last_affected":"6.0"}]}]}}],"versions":["5.0","6.0","v6.0.0","v5.0.9","v5.0.8","v5.0.7","v5.0.6","v5.0.5","v5.0.4","v5.0.3","v5.0.2","v5.0.1","v5.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-51025.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}