CVE-2022-38731

Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a user to specify an arbitrary location on the server's filesystem from which to load an image. (Only images are displayed to the attacker. All other files are loaded but not displayed.) The Content-Type response header reflects the actual content type of the file being requested. This allows an attacker to enumerate files on the local system. Additionally, remote resources can be requested via a UNC path, allowing an attacker to coerce authentication out from the server to the attackers machine.

• CWE-22
• CWE-22

• https://qaelum.com/solutions/doseProduct
• https://www.pwc.co.uk/issues/cyber-security-services/research/ethical-hacking-team-discovered-zero-day-vulnerability.htmlThird Party Advisory
• https://qaelum.com/solutions/doseProduct
• https://www.pwc.co.uk/issues/cyber-security-services/research/ethical-hacking-team-discovered-zero-day-vulnerability.htmlThird Party Advisory

Published

Feb 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3872An off-by-one read/write issue was found in the SDHCI device…8.6
• CVE-2022-38723Gravitee API Management before 3.15.13 allows path traversal…8.6
• CVE-2022-38724Silverstripe silverstripe/framework through 4.11.0, silverst…5.4
• CVE-2022-38725An integer overflow in the RFC3164 parser in One Identity sy…7.5
• CVE-2022-3873Cross-site Scripting (XSS) - DOM in GitHub repository jgraph…6.1
• CVE-2022-38730Docker Desktop for Windows before 4.6 allows attackers to ov…6.3
• CVE-2022-38732SnapCenter versions prior to 4.7 shipped without Content Sec…7.5
• CVE-2022-38733OnCommand Insight versions 7.3.1 through 7.3.14 are suscepti…8.6
• CVE-2022-38734StorageGRID (formerly StorageGRID Webscale) versions prior t…7.5
• CVE-2022-38735Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-38736Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-38737Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…