CVE-2022-46178 HIGH

CVE-2022-46178: Path Traversal In MeterSpere allows file upload to any path

Vendor Metersphere
Product metersphere
Weakness CWE-22 · Path traversal
Published December 29, 2022
Last update April 10, 2025
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.1 allow users to upload a file, but do not validate the file name, which may lead to upload file to any path. The vulnerability has been fixed in v2.5.1. There are no workarounds.

Key dates

02Disclosure timeline

December 29, 2022 CVE published
April 10, 2025 Record updated