{"id":"CVE-2022-0072","aliases":["EUVD-2022-15293","GHSA-f532-g5cf-vhjp"],"status":"published","title":"Directory Traversal in OpenLiteSpeed Web Server","description":"Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01143,"percentile":0.6693,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2022-10-27T19:28:49Z","modified":"2026-10-28T10:23:14Z","products":[{"vendor":"litespeed technologies","product":"litespeed web server"},{"vendor":"litespeed technologies","product":"openlitespeed web server"},{"vendor":"litespeedtech","product":"openlitespeed"}],"references":[{"url":"https://github.com/litespeedtech/openlitespeed/blob/v1.7.16/src/main/httpserver.cpp#L2060-L2061","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/litespeedtech/openlitespeed/blob/v1.7.16.1/src/main/httpserver.cpp#L2060-L2061","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0072","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f532-g5cf-vhjp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0072.json","tags":["advisory"]},{"url":"https://github.com/litespeedtech/openlitespeed","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-0072","title":"Directory Traversal in OpenLiteSpeed Web Server","description":"Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1","status":"published","published":"2022-10-27T19:28:49.031Z","modified":"2025-05-09T19:18:17.065Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15293","description":"Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1","status":"published","published":"2022-10-27T19:28:49Z","modified":"2025-05-09T19:18:17Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:50.201515Z"}],"ghsa":[{"id":"GHSA-f532-g5cf-vhjp","title":"Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server Dashboard...","description":"Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server Dashboard allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1","status":"published","published":"2022-10-28T12:00:35Z","modified":"2023-02-03T05:06:14Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:53:52.260774Z"}],"nvd":[{"id":"CVE-2022-0072","description":"Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1","status":"published","published":"2022-10-27T20:15:12.417Z","modified":"2026-06-17T04:19:56.143Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"CVE-2022-0072","title":"Directory Traversal in OpenLiteSpeed Web Server","description":"Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects versions from 1.5.11 through 1.5.12, from 1.6.5 through 1.6.20.1, from 1.7.0 before 1.7.16.1","status":"published","published":"2022-10-27T19:28:49.031Z","modified":"2026-10-28T10:23:14.511281943Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:22.824781Z"}]}}