CVE-2022-44635

Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and prior versions. We recommend users to upgrade to 1.8.1.

• CWE-22

• http://www.openwall.com/lists/oss-security/2022/11/29/3Mailing List, Third Party Advisory
• https://lists.apache.org/thread/t8q6fmh3o6yqmy69qtqxppk9yg9wfybgMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/11/29/3Mailing List, Third Party Advisory
• https://lists.apache.org/thread/t8q6fmh3o6yqmy69qtqxppk9yg9wfybgMailing List, Vendor Advisory

Published

Nov 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4463Rejected reason: This candidate is unused by its CNA.
• CVE-2022-44630Cross-Site request forgery (CSRF) vulnerability in YITH YITH…4.6
• CVE-2022-44631Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabil…5.4
• CVE-2022-44632Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2022-44633Missing Authorization vulnerability in YITH YITH WooCommerce…6.5
• CVE-2022-44634Auth. (admin+) Arbitrary File Read vulnerability in S2W – Im…4.9
• CVE-2022-44636The Samsung TV (2021 and 2022 model) smart remote control al…4.6
• CVE-2022-44637Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persisten…6.1
• CVE-2022-44638In libpixman in Pixman before 0.42.2, there is an out-of-bou…8.8
• CVE-2022-4464Themify Portfolio Post WordPress plugin before 1.2.1 does no…5.4
• CVE-2022-44640Heimdal before 7.7.1 allows remote attackers to execute arbi…9.8
• CVE-2022-44641In Linaro Automated Validation Architecture (LAVA) before 20…6.5