Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck

CVE-2022-51022YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint

Critical 9.1

In plain English

A critical-severity path traversal in YiShaAdmin from liukuo362573. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.8%top 43.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

Affected products (as reported)

Vendor	Product	Versions
liukuo362573	YiShaAdmin	2.2 – through 3.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

huntr Report technical-description, exploit
Fix Commit patch
Incomplete Fix patch
Nuclei Template technical-description
VulnCheck Advisory: YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint third-party-advisory