Critical 9.1Published Oct 22, 2026

CVE-2022-51022YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint

Updated under an hour ago (Oct 27, 2026, 2:10 AM ET)

Does this affect you?

It affects liukuo362573 YiShaAdmin. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.79%, higher than 56% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for liukuo362573 YiShaAdmin

Exploited in the last 30 days

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

CVSS: 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.79% (percentile 56)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 22, 2026
First seen by InfoSec Signals: Oct 22, 2026

Affected products

Affected products

liukuo362573 YiShaAdmin liukuo362573:yishaadmin (from the name)	from 2.2 through 3.1; 025b0628b1295bd2d9fd6c9b5b82692a345151ef not affected	CNA record

References

References

https://huntr.com/bounties/2acdd87a-12bd-4ce4-994b-0081eb908128	technical-description, exploit
https://github.com/liukuo362573/YiShaAdmin/commit/025b0628b1295bd2d9fd6c9b5b82692a345151ef	patch
https://github.com/liukuo362573/YiShaAdmin/commit/c3b66e66bf6d70a561190cd8da7f4df7b141931d	patch
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/yishaadmin-lfi.yaml	technical-description
https://www.vulncheck.com/advisories/yishaadmin-3.1-unauthenticated-path-traversal-via-downloadfile-endpoint	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.