CVE-2022-32287

A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. This issue affects Apache UIMA Apache UIMA version 3.3.0 and prior versions. Note that PEAR files should never be installed into an UIMA installation from untrusted sources because PEAR archives are executable plugins that will be able to perform any actions with the same privileges as the host Java Virtual Machine.

• CWE-22

• http://www.openwall.com/lists/oss-security/2022/11/03/4Mailing List, Third Party Advisory
• https://lists.apache.org/thread/57vk0d79j94d0lk0vol8xn935yv1shddMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/11/03/4Mailing List, Third Party Advisory
• https://lists.apache.org/thread/57vk0d79j94d0lk0vol8xn935yv1shddMailing List, Vendor Advisory

Published

Nov 3, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32280Authenticated (contributor or higher user role) Stored Cross…5.4
• CVE-2022-32282An improper password check exists in the login functionality…8.8
• CVE-2022-32283Browse restriction bypass vulnerability in Cabinet of Cybozu…4.3
• CVE-2022-32284Use of insufficiently random values vulnerability exists in …7.5
• CVE-2022-32285A vulnerability has been identified in Mendix SAML Module (M…7.5
• CVE-2022-32286A vulnerability has been identified in Mendix SAML Module (M…6.1
• CVE-2022-32288Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-32289Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos P…4.3
• CVE-2022-3229Because the web management interface for Unified Intents' Un…9.8
• CVE-2022-32290The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 h…4.3
• CVE-2022-32291In Real Player through 20.1.0.312, attackers can execute arb…8.8
• CVE-2022-32292In ConnMan through 1.41, remote attackers able to send HTTP …9.8