CVE-2022-22931
Path traversal in Apache James 3.6.1
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
- Record
CVE-2022-22931- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Path traversal in Apache James 3.6.1
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
- Record
CVE-2022-22931- Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2022-1194 No score
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
- Record
EUVD-2022-1194- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v84g-cf5j-xjqx No score
Path Traversal in Apache James Server
Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
- Record
GHSA-v84g-cf5j-xjqx- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
Path traversal in Apache James 3.6.1
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
- Record
CVE-2022-22931- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-v84g-cf5j-xjqx No score
Path Traversal in Apache James Server
Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
- Record
GHSA-v84g-cf5j-xjqx- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.james:james-serverMaven |
before 3.6.2 | 3.6.2 |
org.apache.james:james-serverMaven |
before 3.6.2, plus listed versions 3.0-M13.0-M23.0-beta23.0-beta33.0-beta4 Show 10 moreShow less3.0.03.0.0-RC13.0.0-beta53.0.13.1.03.2.03.3.03.4.03.5.03.6.0 |
3.6.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | shoucheng3/asf__james-project_CVE-2022-22931_3-6-0 | 2025-08-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-22931 is a medium vulnerability (CVSS 4.3) in Apache James, published February 7, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.76%, the 78th percentile. Fixed in org.apache.james:james-server 3.6.2.
References
lists.apache.org/thread/bp8yql4wws56jlh0vxoowj7foothsmpr
openwall.com/lists/oss-security/2022/02/07/1
nvd.nist.gov/vuln/detail/CVE-2022-22931
github.com/apache/james-project/pull/877