CVE-2022-4402

RainyGao DocSys ZIP File Decompression path traversal

Medium4.7EPSS 0.78%

Published: 11 Dec 2022
Updated: 15 Apr 2025
Reserved: 11 Dec 2022
Assigned by: VulDB

Description

A vulnerability classified as critical has been found in RainyGao DocSys 2.02.37. This affects an unknown part of the component ZIP File Decompression Handler. The manipulation leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215271.

Scores

CVSS scores of CVE-2022-4402, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	3.1	Medium4.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
NVDNVD · Modified	3.1	High7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.78% · top 44% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.7.

Weakness

CWE-22 Path Traversal -> CWE-23 Relative Path Traversal -> CWE-24 Path Traversal: '../filedir' (opens in a new tab)All about CWE-22 and its CVEs

Affected products

RainyGao · DocSys
- affected 2.02.37

References (3)

https://github.com/A-TGAO/MxsDocVul/blob/main/ZipSlipVul.md (opens in a new tab)x_transferred
https://gitee.com/RainyGao/DocSys/issues/I65IYU (opens in a new tab)x_transferred
https://vuldb.com/?id.215271 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-4402](https://trackcve.app/badge/CVE-2022-4402.svg)](https://trackcve.app/cve/CVE-2022-4402)

Record last updated 15 Apr 2025, 13:05 UTC.