Search for vulnerabilities
Vulnerability details: VCID-6cyf-atr3-p7gx
Vulnerability ID VCID-6cyf-atr3-p7gx
Aliases CVE-2022-25168
GHSA-8wm5-8h9c-47pc
Summary Apache Hadoop argument injection vulnerability Apache Hadoop's `FileUtil.unTar(File, File)` API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
System Score Found at
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25168.json
epss 0.02753 https://api.first.org/data/v1/epss?cve=CVE-2022-25168
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-8wm5-8h9c-47pc
cvssv3.1 9.8 https://github.com/apache/hadoop
generic_textual CRITICAL https://github.com/apache/hadoop
cvssv3.1 9.8 https://github.com/apache/hadoop/commit/cae749b076f35f0be13a926ee8cfbb7ce4402746
generic_textual CRITICAL https://github.com/apache/hadoop/commit/cae749b076f35f0be13a926ee8cfbb7ce4402746
cvssv3.1 9.8 https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130
generic_textual CRITICAL https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2022-25168
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2022-25168
cvssv3.1 9.8 https://security.netapp.com/advisory/ntap-20220915-0007
generic_textual CRITICAL https://security.netapp.com/advisory/ntap-20220915-0007
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25168.json
https://api.first.org/data/v1/epss?cve=CVE-2022-25168
https://github.com/apache/hadoop
https://github.com/apache/hadoop/commit/cae749b076f35f0be13a926ee8cfbb7ce4402746
https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130
https://nvd.nist.gov/vuln/detail/CVE-2022-25168
https://security.netapp.com/advisory/ntap-20220915-0007
https://security.netapp.com/advisory/ntap-20220915-0007/
2119084 https://bugzilla.redhat.com/show_bug.cgi?id=2119084
GHSA-8wm5-8h9c-47pc https://github.com/advisories/GHSA-8wm5-8h9c-47pc
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-25168.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/hadoop
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/hadoop/commit/cae749b076f35f0be13a926ee8cfbb7ce4402746
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-25168
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20220915-0007
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.85358
EPSS Score 0.02753
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:24:46.435000+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-8wm5-8h9c-47pc/GHSA-8wm5-8h9c-47pc.json 36.1.3