CVE-2022-40443

Deeper analysis

An absolute path traversal vulnerability tracked as CVE-2022-40443 affects ZZCMS 2022 and is assigned CWE-22. The flaw resides in the /one/siteinfo.php script and permits an unauthenticated remote attacker to read arbitrary files on the server by supplying a crafted absolute path in a GET request. It received a CVSS 3.1 base score of 5.3 reflecting network attack vector, low complexity, and no required privileges or user interaction, with impact limited to partial confidentiality loss.

An attacker can exploit the issue simply by issuing a suitably formed HTTP GET to the affected endpoint, bypassing normal access controls to retrieve sensitive configuration files or other data stored on the filesystem. No authentication or special preconditions are needed, making the vulnerability reachable from any network position that can reach the web application.

The associated EPSS score has remained flat at 0.1219 with no material rise after disclosure. Public references consist of GitHub issue reports that document the path traversal vector but supply no additional exploitation details or mitigation guidance.