CVE-2022-45866

MEDIUM 5.3CVE-2022-45866 · Published 23/11/2022 · updated 17/06/2026

In short

CVE-2022-45866 is a MEDIUM (CVSS 5.3) vulnerability affecting qpress (qpress project).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.7% of all vulnerabilities.
Fix: update to 11.3 or later.

Package	Affected versions	Patched versions
qpress qpress_project	`< 11.3`	`11.3`

Description

qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other products, allows directory traversal via ../ in a .qp file.

References

EvgeniyPatlan/qpress commit ddb3120 · Patch
PierreLvx/qpress · Patch
PierreLvx/qpress#6 · Exploit
percona/percona-xtrabackup#1366 · Exploit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQWF7635AJSDKEIGLB73XAH643POGTFY
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4RXO3VYIFRTNIFHWIAZWND6ZXQ5OYOB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUZ73XT2FXLHC7I4ODLOVB4O4QN7Q7JB
pkgs.org/download/qpress · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free