CVE-2022-36537
ZK Framework vulnerable to malicious POST
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
- Record
CVE-2022-36537- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
CVE List
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
- Record
CVE-2022-36537- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
EUVDEUVD-2022-6491
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
- Record
EUVD-2022-6491- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6278-2q4m-cmf3
ZK Framework vulnerable to malicious POST
ZK Framework version 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
- Record
GHSA-6278-2q4m-cmf3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H - Weakness
- CWE-200
- Updated
- 2026-11-02
CISA KEV No score
ZK Framework AuUploader Unspecified Vulnerability
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
- Record
CVE-2022-36537- Weakness
- CWE-441
- Updated
- 2026-11-02
OSV
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
- Record
CVE-2022-36537- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-6278-2q4m-cmf3
ZK Framework vulnerable to malicious POST
ZK Framework version 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
- Record
GHSA-6278-2q4m-cmf3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.zkoss.zk:zkMaven |
before 8.6.4.2 | 8.6.4.2 |
org.zkoss.zk:zkMaven |
9.0.0.0 up to 9.0.1.3 | 9.0.1.3 |
org.zkoss.zk:zkMaven |
9.5.0.0 up to 9.5.1.4 | 9.5.1.4 |
org.zkoss.zk:zkMaven |
9.6.0.0 up to 9.6.0.2 | 9.6.0.2 |
org.zkoss.zk:zkMaven |
9.6.1 up to 9.6.2 | 9.6.2 |
org.zkoss.zk:zkMaven |
before 8.6.4.2, plus listed versions 2.1.32.2.02.2.12.3.02.3.1 Show 45 moreShow less2.4.02.4.12.4.22.4.33.0.03.0.0-RC3.0.13.0.23.0.33.0.43.0.53.0.63.0.73.0.83.5.03.5.13.5.23.6.03.6.0.13.6.13.6.23.6.2-FL-2009-05-113.6.2-FL-200905153.6.2.FL.200905183.6.2.FL.200906153.6.35.0.0.RC5.0.105.0.115.0.75.0.7.15.0.85.0.96.0.06.0.16.0.26.0.2.16.5.06.5.16.5.1.16.5.26.5.36.5.47.0.07.0.0-Preview |
8.6.4.2 |
org.zkoss.zk:zkMaven |
9.0.0.0 up to 9.0.1.3, plus listed versions 9.0.09.0.0.1 |
9.0.1.3 |
org.zkoss.zk:zkMaven |
9.5.0.0 up to 9.5.1.4, plus listed versions 9.5.09.5.0.19.5.0.29.5.0.3 |
9.5.1.4 |
org.zkoss.zk:zkMaven |
9.6.0.0 up to 9.6.0.2, plus listed versions 9.6.09.6.0-jakarta9.6.0.19.6.0.1-jakarta |
9.6.0.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Malwareman007/CVE-2022-36537 | 2022-12-09 |
| PoC in GitHub | agnihackers/CVE-2022-36537-EXPLOIT | 2022-12-09 |
| PoC in GitHub | ethan-repo-lab4b6/CVE-2022-36537 | 2025-09-28 |
| Nuclei | ZK Framework - Information Disclosure |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-36537 is a high vulnerability (CVSS 7.5) in Zk Framework Auuploader, published August 26, 2022. CISA lists it as known to be exploited, since February 27, 2023. EUVD reports exploitation since February 27, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.4%, the 99th percentile. Fixed in org.zkoss.zk:zk 8.6.4.2.
References
tracker.zkoss.org/browse/ZK-5150
bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36537
nvd.nist.gov/vuln/detail/CVE-2022-36537
github.com/zkoss/zk/commit/92a29aa9b1daf1fd2d9d188cb6545f0441d54e84
Left out here: 10 versions. The JSON record has them.