CVE-2022-26652: Path Traversal
Published Mar 10, 2022
·Updated
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.
Affected Software
3 affected components
NATS NATS Server>=2.2.0<2.7.4
NATS NATS Streaming Server>=0.15.0<0.24.3
linuxfoundation Nats-server>=2.2.0<2.7.4
Event History
Mar 10, 2022
CVE Published
via MITRE·03:48 AM
Data Sourced
via MITRE·03:48 AM
Description
Data Sourced
via NVD·05:47 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-26652?
The severity of CVE-2022-26652 is medium.
2
How does CVE-2022-26652 affect NATS nats-server?
CVE-2022-26652 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams in NATS nats-server versions before 2.7.4.
3
Which versions of NATS nats-server are affected by CVE-2022-26652?
NATS nats-server versions between 2.2.0 and 2.7.3 are affected by CVE-2022-26652.
4
How does CVE-2022-26652 affect NATS nats-streaming-server?
CVE-2022-26652 also affects NATS nats-streaming-server versions before 0.24.3.
5
Are there any fixes or patches available for CVE-2022-26652?
Yes, NATS nats-server version 2.7.4 and NATS nats-streaming-server version 0.24.3 contain fixes for CVE-2022-26652.