{"id":"CVE-2022-26884","aliases":["EUVD-2022-7169","GHSA-vpgf-fgm8-gxr2"],"status":"published","title":"Apache DolphinScheduler exposes files without authentication","description":"Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01821,"percentile":0.79037,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2022-10-28T00:00:00Z","modified":"2026-10-28T02:31:13Z","exploits":[{"source":"pocgithub","id":"shoucheng3/apache__dolphinscheduler_CVE-2022-26884_2-0-5","title":"shoucheng3/apache__dolphinscheduler_CVE-2022-26884_2-0-5","date":"2025-08-16","url":"https://github.com/shoucheng3/apache__dolphinscheduler_CVE-2022-26884_2-0-5"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.dolphinscheduler:dolphinscheduler","fixed_in":["2.0.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.dolphinscheduler:dolphinscheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.dolphinscheduler:dolphinscheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6"}]}],"versions":["1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","2.0.0","2.0.0-alpha","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5"]}],"products":[{"vendor":"apache","product":"dolphinscheduler"},{"vendor":"apache software foundation","product":"apache dolphinscheduler"}],"references":[{"url":"https://lists.apache.org/thread/xfdst5y4hnrm2ntmc5jzrgmw2htyyb9c","tags":["x_transferred","Mailing List","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/10/28/2","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26884","tags":["advisory"]},{"url":"https://github.com/apache/dolphinscheduler/releases/tag/2.0.6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vpgf-fgm8-gxr2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26884.json","tags":["advisory"]},{"url":"https://github.com/apache/dolphinscheduler","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-26884","title":"Apache DolphinScheduler exposes files without authentication","description":"Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.","status":"published","published":"2022-10-28T00:00:00Z","modified":"2025-05-07T15:36:46.343Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-7169","description":"Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.","status":"published","published":"2022-10-28T00:00:00Z","modified":"2025-05-07T15:36:46Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:53.098709Z"}],"ghsa":[{"id":"GHSA-vpgf-fgm8-gxr2","title":"Apache DolphinScheduler vulnerable to Path Traversal","description":"Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.","status":"published","published":"2022-10-28T12:00:33Z","modified":"2023-01-30T05:03:03Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:28.424013Z"}],"nvd":[{"id":"CVE-2022-26884","description":"Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.","status":"published","published":"2022-10-28T08:15:08.927Z","modified":"2026-06-17T04:36:03.417Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"CVE-2022-26884","title":"Apache DolphinScheduler exposes files without authentication","description":"Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.","status":"published","published":"2022-10-28T00:00:00Z","modified":"2026-10-28T02:31:13.911595139Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"GHSA-vpgf-fgm8-gxr2","title":"Apache DolphinScheduler vulnerable to Path Traversal","description":"Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.","status":"published","published":"2022-10-28T12:00:33Z","modified":"2023-11-08T04:08:55.221147Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:57.694388Z"}]}}