Read the docs
TI-2022-07530 Aliases CVE-2022-23470

Arbitrary file access in the Galaxy data analysis platform

Priority MEDIUM 45CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and higher, after the switch to gunicorn, which serve static contents directly. Additionally, the vulnerability is mitigated when using Nginx or Apache to serve /static/* contents, instead of Galaxy's internal middleware. This issue has been patched in commit `e5e6bda4f` and will be included in future releases. Users are advised to manually patch their installations. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00852 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
galaxyprojectgalaxy22.01 – 22.05—No fix listedCNA
  • galaxy Vendorgalaxyproject Affected 22.01 – 22.05 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:galaxyproject:galaxy:*:*:*:*:*:*:*:*22.01 – 22.05Vulnerablegalaxyproject
  • cpe:2.3:a:galaxyproject:galaxy:*:*:*:*:*:*:*:* Versions 22.01 – 22.05 Vulnerable ·galaxyproject

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23470

References

Patch 2

  • TI-2023-22903 Galaxy vulnerable to Server Side Request Forgery during data imports CVSS 3.1MEDIUM 6.3
  • TI-2023-12288 Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check CVSS 3.1CRITICAL 9.1
  • TI-2015-07990 galaxy-data-resource Command Line Template injection CVSS 3.1CRITICAL 9.8
  • TI-2024-28338 Possible Data Tampering & Loss of Public Datasets in Galaxy CVSS 3.1CRITICAL 9.1
  • TI-2024-28333 Stored Cross Site Scripting (Stored XSS) in Galaxy CVSS 3.1HIGH 7.6
  • TI-2018-15916 The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences