Path traversal in CureKit

HOCH 7.5CVE-2022-23082 · GHSA-m9vj-44f3-78xw · Published 31/05/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-23082 ist eine Schwachstelle (HOCH (CVSS 7.5)) in io.whitesource:curekit, curekit (mend).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.3%, höher als bei 71.2% aller Schwachstellen.
Abhilfe: auf 1.1.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
io.whitesource:curekit Maven	`≥ 1.0.1, < 1.1.4`	`1.1.4`
curekit mend	`≥ 1.0.1, ≤ 1.1.3`	No fix yet

Description

CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.

NVD description

In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.

References

nvd.nist.gov/vuln/detail/CVE-2022-23082 · ADVISORY
whitesource/CureKit commit af35e87 · WEB
whitesource/CureKit · PACKAGE
mend.io/vulnerability-database/CVE-2022-23082 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free