CVE-2022-39221

McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program, to be read by anyone via HTTP request. Version 0.2.0 with patches are released to both platforms (Fabric and Quilt, Forge). As a workaround, the McWebserver mod can be disabled by removing the file from the `mods` directory.

• CWE-22

• https://github.com/J-onasJones/McWebserver/pull/1Patch, Third Party Advisory
• https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46qThird Party Advisory
• https://github.com/J-onasJones/McWebserver/pull/1Patch, Third Party Advisory
• https://github.com/J-onasJones/McWebserver/security/advisories/GHSA-gcvq-42cx-r46qThird Party Advisory

Published

Sep 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39216Combodo iTop is an open source, web-based IT service managem…9.8
• CVE-2022-39217some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) i…9.8
• CVE-2022-39218The JS Compute Runtime for Fastly's Compute@Edge platform pr…7.5
• CVE-2022-39219Bifrost is a middleware package which can synchronize MySQL/…6.5
• CVE-2022-3922The Broken Link Checker WordPress plugin before 1.11.20 does…4.8
• CVE-2022-39220SFTPGo is an SFTP server written in Go. Versions prior to 2.…6.1
• CVE-2022-39222Dex is an identity service that uses OpenID Connect to drive…6.5
• CVE-2022-39224Arr-pm is an RPM reader/writer library written in Ruby. Vers…7.8
• CVE-2022-39225Parse Server is an open source backend that can be deployed …3.1
• CVE-2022-39226Discourse is an open source discussion platform. In versions…4.3
• CVE-2022-39227python-jwt is a module for generating and verifying JSON Web…9.1
• CVE-2022-39228vantage6 is a privacy preserving federated learning infrastr…6.5