{"id":"CVE-2022-29464","published":"2022-04-18T22:15:09Z","modified":"2026-06-17T04:40:13Z","title":"WSO2 Multiple Products Unrestrictive Upload of File Vulnerability","vendor":"WSO2","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an unrestricted file upload in multiple WSO2 products, including API Manager, Identity Server, Identity Server as Key Manager, Enterprise Integrator and Open Banking AM and KM, where directory traversal via a Content-Disposition sequence on the /fileupload endpoint lets uploaded files be written outside the intended location. An attacker with network access and no authentication or user interaction can send a crafted upload that places a file under the web root, such as the repository/deployment/server/webapps directory, leading to remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:43:47Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99992,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-04-25","dueDate":"2022-05-16","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-29464","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-04-22","exploitedFirstSeen":"2022-04-22","ransomware":true,"evidence":[{"url":"https://www.rapid7.com/blog/post/2022/04/22/opportunistic-exploitation-of-wso2-cve-2022-29464/","date":"2022-04-22"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-04-25"},{"url":"https://www.trendmicro.com/en_us/research/22/e/patch-your-wso2-cve-2022-29464-exploited-to-install-linux-compatible-cobalt-strike-beacons-other-malware.html","date":"2022-05-31"},{"url":"https://www.lacework.com/blog/kinsing-dark-iot-botnet-among-threats-targeting-cve-2022-26134/","date":"2022-06-07"},{"url":"https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/","date":"2022-08-19"},{"url":"https://research.nccgroup.com/2022/09/30/a-glimpse-into-the-shadowy-realm-of-a-chinese-apt-detailed-analysis-of-a-shadowpad-intrusion/","date":"2022-09-30"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-215a","date":"2023-08-03"},{"url":"https://www.cisa.gov/sites/default/files/2023-08/CSRB_Lapsus%24_508c.pdf","date":"2023-08-10"},{"url":"https://www.microsoft.com/content/dam/microsoft/final/en-us/microsoft-brand/documents/MDDR_FINAL_2023_1004.pdf","date":"2023-10-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2022-29464","date":"2023-11-13"}],"evidenceTotal":752,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/22/7","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/hakivvi/CVE-2022-29464","tags":["Exploit","Third Party Advisory"]},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2022/04/22/7","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/hakivvi/CVE-2022-29464","tags":["Exploit","Third Party Advisory"]},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2022-29464 is an unrestricted file upload vulnerability where an adversary can upload arbitrary files and, due to a directory traversal issue, write files to locations where they can then send commands. Adversaries have been seen to use this to mine cryptocurrency.","confidence":"high"},{"id":"T1202","name":"Indirect Command Execution","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"primary_impact","evidence":[],"comment":"CVE-2022-29464 is an unrestricted file upload vulnerability where an adversary can upload arbitrary files and, due to a directory traversal issue, write files to locations where they can then send commands. Adversaries have been seen to use this to mine cryptocurrency.","confidence":"high"},{"id":"T1496","name":"Resource Hijacking","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2022-29464 is an unrestricted file upload vulnerability where an adversary can upload arbitrary files and, due to a directory traversal issue, write files to locations where they can then send commands. Adversaries have been seen to use this to mine cryptocurrency.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-33802","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33802","exploited":true,"exploitedSince":"2022-04-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":25,"skipped":4,"earliest":"2022-04-20","earliestUrl":"https://github.com/hakivvi/CVE-2022-29464","repos":[{"name":"hakivvi/CVE-2022-29464","url":"https://github.com/hakivvi/CVE-2022-29464","stars":379,"created":"2022-04-20"},{"name":"dsssssssm/WSOB","url":"https://github.com/dsssssssm/WSOB","stars":27,"created":"2022-04-24"},{"name":"sh4den/CVE-2022-29464","url":"https://github.com/sh4den/CVE-2022-29464","stars":10,"created":"2022-05-15"},{"name":"Ap0dexMe0/CVE-2022-29464","url":"https://github.com/Ap0dexMe0/CVE-2022-29464","stars":10,"created":"2023-04-25"},{"name":"gbrsh/CVE-2022-29464","url":"https://github.com/gbrsh/CVE-2022-29464","stars":7,"created":"2022-11-14"}]},"metasploit":[{"name":"WSO2 Arbitrary File Upload to RCE","module":"exploit/multi/http/wso2_file_upload_rce","type":"exploit","disclosureDate":"2022-04-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wso2_file_upload_rce.rb"}],"nuclei":[{"id":"CVE-2022-29464","name":"WSO2 Management - Arbitrary File Upload & Remote Code Execution","severity":"critical","path":"http/cves/2022/CVE-2022-29464.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29464.yaml"}],"first":{"date":"2022-04-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wso2_file_upload_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html","https://github.com/hakivvi/CVE-2022-29464"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1202"],"provenance":"source"},{"stage":"secondary","techniques":["T1496"],"provenance":"source"}],"timeline":[{"date":"2022-04-01","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-04-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wso2_file_upload_rce.rb","provenance":"source"},{"date":"2022-04-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29464","provenance":"source"},{"date":"2022-04-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.rapid7.com/blog/post/2022/04/22/opportunistic-exploitation-of-wso2-cve-2022-29464/","provenance":"source"},{"date":"2022-04-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-04-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33802","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":7},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1652 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 25 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}