TI-2022-16104 Aliases CVE-2022-35631 GHSA-3wmf-q566-h69q

Filesystem race on temporary files

LOW 24CWE-377Published 2022-07-29 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.6.5-2.

Why it matters now

EPSS 0.00231 14th percentileScored 2026-11-07

Fix Fixed Velociraptor (Rapid7): 0.6.5-2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Rapid7	Velociraptor	0.6.5-2 to before 0.6.5-2	0.6.5-2	Patch available	CNA

Velociraptor VendorRapid7 Affected 0.6.5-2 to before 0.6.5-2 Fixed in 0.6.5-2 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:rapid7:velociraptor::::::::	before 0.6.5-2	Vulnerable	Rapid7
cpe:2.3:o:apple:macos:-:::::::*	not specified by NVD	Running on	Apple
cpe:2.3:o:linux:linux_kernel:-:::::::*	not specified by NVD	Running on	Linux

cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:* Versions before 0.6.5-2 Vulnerable ·Rapid7
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux

Remediation

Fix · CNA Velociraptor (Rapid7) Fixed in 0.6.5-2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-07-29
Rapid7 Velociraptor 0.6.5-2
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2022-16103 Unsafe HTML Injection in Artifact Collection ReportPriority LOW 28
- TI-2022-16102 Velociraptor Client ID SpoofingPriority LOW 25
- TI-2022-16105 XSS in User InterfacePriority LOW 23
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-35631
2026-10-03 Alias added: GHSA-3wmf-q566-h69q

References

Patch 1

https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/

TI-2023-05481 Rapid7 Velociraptor Reflected XSS CVSS 3.1HIGH 8.6
TI-2026-05514 Velociraptor Query() Plugin Misapplies Permissions To Orgs CVSS 3.1CRITICAL 9.1
TI-2026-04661 Rapid7 Velociraptor Improper Input Validation in Client Message Handler CVSS 3.1HIGH 8.5
TI-2023-00229 Insufficient permission check in the VQL copy() function CVSS 3.1HIGH 8.8
TI-2026-06659 GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations CVSS 3.1HIGH 7.7
TI-2025-13446 Rapid7 Velociraptor Directory Traversal Vulnerability CVSS 3.1MEDIUM 6.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences