CVE-2022-26652 identifies a directory traversal vulnerability with write access in NATS nats-server before version 2.7.4 and nats-streaming-server before 0.24.3. This flaw allows an authenticated attacker to write arbitrary files outside the intended directory by manipulating elements within a ZIP archive used for JetStream streams. Rated with a CVSS score of 6.5 (Medium), the vulnerability has a network attack vector and low attack complexity, requiring low privileges and no user interaction, with a primary impact on data integrity. There is currently no evidence of active exploitation, public exploit code is unavailable, and community discussion or media coverage is minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.2.0, < 2.7.4CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:* | ||
>= 0.15.0, < 0.24.3CPE matchmatch criteria | cpe:2.3:a:nats:nats_streaming_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.