CVE-2022-47878

CVE-2022-47878 is a critical vulnerability affecting Jedox versions 22.2 and earlier, specifically on-premises deployments. It stems from incorrect input validation in the settings page, allowing authenticated remote attackers to set the default storage path to the webroot directory. This misconfiguration enables subsequent file uploads to execute arbitrary code, leading to a complete compromise of the system. With a CVSS score of 8.8 (High), the vulnerability is easily exploitable over the network with low privileges and no user interaction, resulting in high impact to confidentiality, integrity, and availability. While not actively exploited in the wild and not on CISA's KEV list, public exploit code exists (EDB-51426), indicating a clear and present risk for unpatched systems.