Vulnerability · Published Nov 3, 2022 · Assigned by apache
CVE-2022-32287Apache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archives
High 7.5
In plain English
A high-severity path traversal in Apache UIMA from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. This issue affects Apache UIMA Apache UIMA version 3.3.0 and prior versions. Note that PEAR files should never be installed into an UIMA installation from untrusted sources because PEAR archives are executable plugins that will be able to perform any actions with the same privileges as the host Java Virtual Machine.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.uima:uimaj-core | 3.3.1 | GHSA-xgqr-5wqw-9fpv |
| Ubuntu:22.04:LTS | uimaj | no fix listed | UBUNTU-CVE-2022-32287 |
| Ubuntu:24.04:LTS | uimaj | no fix listed | UBUNTU-CVE-2022-32287 |
| Ubuntu:25.10 | uimaj | no fix listed | UBUNTU-CVE-2022-32287 |
| Ubuntu:26.04:LTS | uimaj | no fix listed | UBUNTU-CVE-2022-32287 |
| Ubuntu:26.10 | uimaj | no fix listed | UBUNTU-CVE-2022-32287 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache UIMA | Java SDK – through 3.3.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N