CVE-2022-51022 is a critical unauthenticated path traversal flaw in YiShaAdmin 2.2 through 3.1 that lets remote attackers read or delete arbitrary files, and the Shadowserver Foundation first observed exploitation evidence on 2023-10-20.
What Is It
The flaw (CWE-22) is in YiShaAdmin's /admin/File/DownloadFile endpoint. The endpoint accepts a filePath parameter but does not stop directory traversal sequences in it. An attacker can send a crafted GET request with traversal sequences in filePath and set the delete parameter to read or remove system files such as etc/passwd. The endpoint requires no authentication.
VulnCheck assigned the CVE. It was published to NVD on 2026-10-22 and currently has the status "Received."
Why It Matters
- Severity: CVSS 3.1 base score is 9.1 (Critical) (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H). The CVSS 4.0 score is 8.8 (High). - Easy to exploit: It works over the network, needs no privileges or user interaction, and has low attack complexity.
- Impact: It can expose sensitive files (high confidentiality impact) and delete them (high availability impact).
- Exploitation: The CVE record says the Shadowserver Foundation first observed exploitation evidence on 2023-10-20, about three years before the CVE was published.
- Public tooling: A public ProjectDiscovery Nuclei template for this issue is listed in the references, so automated scanning for it is easy.
The supplied CISA KEV data contains no entry for this CVE, so KEV does not confirm active exploitation and gives no federal remediation deadline. The only exploitation evidence comes from the Shadowserver observation in the CVE record.
What's Vulnerable
- Vendor: liukuo362573
- Product: YiShaAdmin (
pkg:github/liukuo362573/YiShaAdmin) - Affected versions: 2.2 through 3.1
- Unaffected: code at commit
025b0628b1295bd2d9fd6c9b5b82692a345151efand later
NVD lists no CPE entries for this record.
Patch Status
The project fixed the flaw in commit 025b062. Anyone running YiShaAdmin 2.2–3.1 should update to a build that includes this commit. The references also cite a second commit (c3b66e6), but the record does not say what it does.
Because exploitation has been observed since 2023, any YiShaAdmin instance reachable from the internet should be treated as possibly exposed. Owners should check whether sensitive files were read or deleted through the DownloadFile endpoint.