CVE-2022-29464

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

• CWE-22
• CWE-22

• http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2022/04/22/7Mailing List, Third Party Advisory
• https://github.com/hakivvi/CVE-2022-29464Exploit, Third Party Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/Vendor Advisory
• http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2022/04/22/7Mailing List, Third Party Advisory
• https://github.com/hakivvi/CVE-2022-29464Exploit, Third Party Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464US Government Resource

Published

Apr 18, 2022

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29453Cross-Site Request Forgery (CSRF) vulnerability in API KEY f…4.3
• CVE-2022-29454Cross-Site Request Forgery (CSRF) vulnerability in WordPlus …4.3
• CVE-2022-29455DOM-based Reflected Cross-Site Scripting (XSS) vulnerability…6.1
• CVE-2022-29457Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlu…8.8
• CVE-2022-29458ncurses 6.3 before patch 20220416 has an out-of-bounds read …7.1
• CVE-2022-2946Use After Free in GitHub repository vim/vim prior to 9.0.024…7.8
• CVE-2022-29465An out-of-bounds write vulnerability exists in the PSD Heade…9.8
• CVE-2022-29466Improper input validation in firmware for Intel(R) SPS befor…5.5
• CVE-2022-29467Address information disclosure vulnerability in Cybozu Garoo…4.3
• CVE-2022-29468A cross-site request forgery (CSRF) vulnerability exists in …8.8
• CVE-2022-29469Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-2947 Altair HyperView Player versions 2021.1.0.27 and prior pe…7.8