TI-2022-07251 Aliases CVE-2022-23082 GHSA-m9vj-44f3-78xw

CureKit - Path Traversal in isFileOutsideDir

LOW 36CWE-22Published 2022-05-31 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.

Why it matters now

EPSS 0.01329 71st percentileScored 2026-11-07

Fix Fixed io.whitesource:curekit (Maven): 1.1.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WhiteSource	CureKit	v1.0.1 and later; up to v1.1.3	—	No fix listed	CNA
—	io.whitesource:curekit (Maven)	1.0.1 to before 1.1.4	1.1.4	Patch available	GHSA-m9vj-44f3-78xw

CureKit VendorWhiteSource Affected v1.0.1 and later; up to v1.1.3 Fixed in — No fix listed CNA
io.whitesource:curekit (Maven) Vendor— Affected 1.0.1 to before 1.1.4 Fixed in 1.1.4 Patch available GHSA-m9vj-44f3-78xw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mend:curekit::::::::	1.0.1 – 1.1.3	Vulnerable	mend

cpe:2.3:a:mend:curekit:*:*:*:*:*:*:*:* Versions 1.0.1 – 1.1.3 Vulnerable ·mend

Remediation

Fix · GHSA-m9vj-44f3-78xw io.whitesource:curekit (Maven) Fixed in 1.1.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-23082
2026-10-03 Alias added: GHSA-m9vj-44f3-78xw

References

Patch 1

https://github.com/whitesource/CureKit/commit/af35e870ed09411d2f1fae6db1b04598cd1a31b6

Advisory 2

Other 1

https://github.com/whitesource/CureKit

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences