YiShaAdmin Path Traversal Flaw Allows Unauthenticated File Deletion

YiShaAdmin versions 2.2 through 3.1 contain a high-severity path traversal vulnerability that allows unauthenticated attackers to read and delete arbitrary files on affected systems. The flaw exists in the /admin/File/DownloadFile endpoint and is identified as CVE-2022-51022.

The vulnerability carries a CVSS score of 8.8, which classifies it as high severity. It stems from improper handling of the filePath parameter, allowing directory traversal sequences. Attackers can send crafted GET requests to access sensitive system files, such as etc/passwd, or delete them entirely by setting the delete parameter.

Context and Background

The Shadowserver Foundation first observed evidence of this vulnerability being exploited on October 20, 2023. This indicates that the flaw has been observed in exploitation attempts since at least that date. The weakness is categorized under CWE-22, which relates to path traversal issues in web applications.

As Threat Times reported on October 22, 2026, similar path traversal flaws in tools like the awsdac CLI can lead to arbitrary code execution. While the YiShaAdmin flaw primarily allows file read and delete operations, the underlying mechanism of manipulating file paths poses significant risks to system integrity and data confidentiality.

Who Is Affected

The vulnerability affects YiShaAdmin software versions 2.2 through 3.1. The software is developed by liukuo362573. Any organization using these specific versions of the administration panel is potentially exposed to unauthenticated attacks. The fix was implemented in commit 025b062, which addresses the improper validation of the filePath parameter.

Organizations running vulnerable versions should verify their current software state immediately. Since exploitation evidence dates back to late 2023, the vulnerability has been present in the wild for some time. The lack of authentication requirements for the endpoint lowers the barrier for attackers significantly.

What should you do?

Administrators should check their YiShaAdmin installations to ensure they are not running versions 2.2 through 3.1. If a vulnerable version is detected, apply the patch from commit 025b062 or upgrade to a version where the fix is confirmed. Monitor server logs for unusual GET requests to the /admin/File/DownloadFile endpoint, particularly those containing directory traversal sequences.