TI-2022-12196 Aliases CVE-2022-29836 GHSA-7c3q-7247-h3cx

Post-Auth Path Traversal Vulnerability Allows to Custom Package Installation via HTTP API

LOW 20CWE-22Published 2022-11-09 · Updated 2025-05-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; My Cloud Home Duo; and SanDisk ibi devices that could allow an attacker to abuse certain parameters to point to random locations on the file system. This could also allow the attacker to initiate the installation of custom packages at these locations. This can only be exploited once the attacker has been authenticated to the device. This issue affects: Western Digital My Cloud Home and My Cloud Home Duo versions prior to 8.11.0-113 on Linux; SanDisk ibi versions prior to 8.11.0-113 on Linux.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00362 30th percentileScored 2026-11-07

Fix Fixed My Cloud Home (Western Digital): 8.11.0-113ibi (SanDisk): 8.11.0-113

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Western Digital	My Cloud Home	My Cloud Home to before 8.11.0-113; My Cloud Home Duo to before 8.11.0-113	8.11.0-113	Patch available	CNA
SanDisk	ibi	ibi to before 8.11.0-113	8.11.0-113	Patch available	CNA

My Cloud Home VendorWestern Digital Affected My Cloud Home to before 8.11.0-113; My Cloud Home Duo to before 8.11.0-113 Fixed in 8.11.0-113 Patch available CNA
ibi VendorSanDisk Affected ibi to before 8.11.0-113 Fixed in 8.11.0-113 Patch available CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:o:westerndigital:my_cloud_home_firmware::::::::	before 8.11.0-113	Vulnerable	Westerndigital
cpe:2.3:h:westerndigital:my_cloud_home:-:::::::*	not specified by NVD	Running on	Westerndigital
cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware::::::::	before 8.11.0-113	Vulnerable	Westerndigital
cpe:2.3:h:westerndigital:my_cloud_home_duo:-:::::::*	not specified by NVD	Running on	Westerndigital
cpe:2.3:o:westerndigital:sandisk_ibi_firmware::::::::	before 8.11.0-113	Vulnerable	Westerndigital
cpe:2.3:h:westerndigital:sandisk_ibi:-:::::::*	not specified by NVD	Running on	Westerndigital

cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:* Versions before 8.11.0-113 Vulnerable ·Westerndigital
cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:* Versions before 8.11.0-113 Vulnerable ·Westerndigital
cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:* Versions before 8.11.0-113 Vulnerable ·Westerndigital
cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital

Remediation

Fix · CNA My Cloud Home (Western Digital) Fixed in 8.11.0-113
Fix · CNA ibi (SanDisk) Fixed in 8.11.0-113

Timeline

2026-10-02 Threatist record created from CVE-2022-29836
2026-10-03 Alias added: GHSA-7c3q-7247-h3cx

References

Advisory 1

https://www.westerndigital.com/support/product-security/wdc-22016-my-cloud-home-ibi-firmware-version-8-11-0-113

TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences