CVE-2022-1119 HIGH

CVE-2022-1119: Simple File List <= 3.2.7 - Arbitrary File Download

Vendor Eemitch

Product Simple File List

Weakness CWE-22 · Path traversal

Published April 19, 2022

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7.

Key dates

02Disclosure timeline

April 19, 2022 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1119 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html

Related vulnerabilities

04Related CVE

CVE-2026-27734 Beszel Vulnerable to Docker API Path Traversal via Unsanitized Container ID CVE-2024-29180 webpack-dev-middleware Path Traversal vulnerability CVE-2024-7950 WP Job Portal <= 2.1.6 - Missing Authorization to Unauthenticated Local File Inclusion, Arbitrary Settings Update, and User Creation CVE-2026-8113 8421bit MiniClaw executeSkillScript kernel.ts isPathInside path traversal CVE-2026-49061 WordPress WPC Product Options for WooCommerce plugin <= 3.2.1 - Arbitrary File Download vulnerability