CVE-2022-39296

MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versions of `melisplatform/melis-asset-manager`, leading to the disclosure of sensitive information. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-asset-manager` >= 5.0.1. This issue was addressed by restricting access to files to intended directories only.

• CWE-22

• https://github.com/melisplatform/melis-asset-manager/commit/a0f75918c049aff78953a0bc91c585153595d1bdPatch, Third Party Advisory
• https://github.com/melisplatform/melis-asset-manager/security/advisories/GHSA-7fj2-rrq6-rphqPatch, Third Party Advisory
• https://github.com/melisplatform/melis-asset-manager/commit/a0f75918c049aff78953a0bc91c585153595d1bdPatch, Third Party Advisory
• https://github.com/melisplatform/melis-asset-manager/security/advisories/GHSA-7fj2-rrq6-rphqPatch, Third Party Advisory

Published

Oct 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39290ZoneMinder is a free, open source Closed-circuit television …6.5
• CVE-2022-39291ZoneMinder is a free, open source Closed-circuit television …5.4
• CVE-2022-39292Slack Morphism is a modern client library for Slack Web/Even…7.5
• CVE-2022-39293Azure RTOS USBX is a high-performance USB host, device, and …9.8
• CVE-2022-39294conduit-hyper integrates a conduit application with the hype…7.5
• CVE-2022-39295Knowage is an open source suite for modern business analytic…6.1
• CVE-2022-39297MelisCms provides a full CMS for Melis Platform, including t…9.8
• CVE-2022-39298MelisFront is the engine that displays website hosted on Mel…9.8
• CVE-2022-39299Passport-SAML is a SAML 2.0 authentication provider for Pass…8.1
• CVE-2022-3930The Directorist WordPress plugin before 7.4.2.2 suffers from…6.5
• CVE-2022-39300node SAML is a SAML 2.0 library based on the SAML implementa…8.1
• CVE-2022-39301sra-admin is a background rights management system that sepa…5.4