Widoco Path Traversal vulnerability

HIGH 7.8CVE-2022-4772 · GHSA-jj8r-jw42-mw4w · Published 27/12/2022 · updated 17/06/2026

In short

CVE-2022-4772 is a HIGH (CVSS 7.8) vulnerability affecting com.github.dgarijo:Widoco, widoco (widoco project).
Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 22.4% of all vulnerabilities.
Fix: update to 2022-07-29 or later.

Package	Affected versions	Patched versions
com.github.dgarijo:Widoco Maven	`≤ 1.4.17`	No fix yet
widoco widoco_project	`< 2022-07-29`	`2022-07-29`

Description

A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.

NVD description

A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2022-4772 · ADVISORY
dgarijo/Widoco#551 · WEB
dgarijo/Widoco commit f2279b7 · WEB
dgarijo/Widoco · PACKAGE
vuldb.com · WEB
vuldb.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.github.dgarijo:Widoco

Maven

≤ 1.4.17

No fix yet

widoco

widoco_project

< 2022-07-29

2022-07-29

Description

NVD description