CVE-2022-45133
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-22

Last updated on: 2025-09-05

Assigner: MITRE

Description
Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. A particularly structured XML file could allow one to traverse the server to obtain access to secure files or cause code execution based on the payload.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-22
Last Modified
2025-09-05
Generated
2026-06-16
AI Q&A
2025-08-22
EPSS Evaluated
2026-06-14
NVD
CVE-2022-45133
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
mahara mahara From 21.10.0 (inc) to 21.10.6 (exc)
mahara mahara From 22.04.0 (inc) to 22.04.4 (exc)
mahara mahara From 22.10.0 (inc) to 22.10.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-26 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Mahara versions before 21.10.6, 22.04.4, and 22.10.1 allows unsafe font uploads for skins. Specifically, a specially crafted XML file can be used to traverse the server's file system, potentially giving access to secure files or enabling code execution based on the payload within the XML.

Impact Analysis

The vulnerability can impact you by allowing an attacker to access secure files on the server or execute arbitrary code. This could lead to unauthorized data disclosure, system compromise, or further exploitation of the affected server.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-45133. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart