Search for vulnerabilities
Vulnerability details: VCID-rb7k-f4rm-7kaj
Vulnerability ID VCID-rb7k-f4rm-7kaj
Aliases CVE-2022-26612
GHSA-gx2c-fvhc-ph4j
Summary Path traversal in Hadoop In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-281 Improper Preservation of Permissions
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-26612.json
epss 0.0015 https://api.first.org/data/v1/epss?cve=CVE-2022-26612
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-gx2c-fvhc-ph4j
cvssv3.1 9.8 https://github.com/apache/hadoop
generic_textual CRITICAL https://github.com/apache/hadoop
cvssv3.1 9.8 https://lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz
generic_textual CRITICAL https://lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2022-26612
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2022-26612
cvssv3.1 9.8 https://security.netapp.com/advisory/ntap-20220519-0004
generic_textual CRITICAL https://security.netapp.com/advisory/ntap-20220519-0004
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-26612.json
https://api.first.org/data/v1/epss?cve=CVE-2022-26612
https://github.com/apache/hadoop
https://lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz
https://nvd.nist.gov/vuln/detail/CVE-2022-26612
https://security.netapp.com/advisory/ntap-20220519-0004
https://security.netapp.com/advisory/ntap-20220519-0004/
2073923 https://bugzilla.redhat.com/show_bug.cgi?id=2073923
GHSA-gx2c-fvhc-ph4j https://github.com/advisories/GHSA-gx2c-fvhc-ph4j
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-26612.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/hadoop
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-26612
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20220519-0004
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.36581
EPSS Score 0.0015
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:22:59.516873+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-gx2c-fvhc-ph4j/GHSA-gx2c-fvhc-ph4j.json 36.1.3