Read the docs
TI-2022-16674 Aliases CVE-2022-36327GHSA-w8xh-67qr-h5gr

Path traversal vulnerability leading to an arbitrary file write in Western Digital devices

Priority MEDIUM 45CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to remote code execution was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires an authentication bypass issue to be triggered before this can be exploited.  This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01466 73rd percentileScored 2026-11-07
Fix Fixed My Cloud Home and My Cloud Home Duo (Western Digital): 9.4.0-191ibi (SanDisk): 9.4.0-191+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Western DigitalMy Cloud Home and My Cloud Home Duobefore 9.4.0-191 9.4.0-191Patch availableCNA
SanDiskibibefore 9.4.0-191 9.4.0-191Patch availableCNA
Western DigitalMy Cloud OS 5before 5.26.2025.26.202Patch availableCNA
  • My Cloud Home and My Cloud Home Duo VendorWestern Digital Affected before 9.4.0-191 Fixed in 9.4.0-191 Patch available CNA
  • ibi VendorSanDisk Affected before 9.4.0-191 Fixed in 9.4.0-191 Patch available CNA
  • My Cloud OS 5 VendorWestern Digital Affected before 5.26.202 Fixed in 5.26.202 Patch available CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:o:westerndigital:my_cloud_os_5:*:*:*:*:*:*:*:*before 5.26.202VulnerableWesterndigital
cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
  • cpe:2.3:o:westerndigital:my_cloud_os_5:*:*:*:*:*:*:*:* Versions before 5.26.202 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:*before 9.4.0-191VulnerableWesterndigital
cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:*before 9.4.0-191VulnerableWesterndigital
cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:*before 9.4.0-191VulnerableWesterndigital
cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:*not specified by NVDRunning onWesterndigital
  • cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital
  • cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:* Versions before 9.4.0-191 Vulnerable ·Westerndigital
  • cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Westerndigital

Remediation

  • Fix · CNA My Cloud Home and My Cloud Home Duo (Western Digital) Fixed in 9.4.0-191
  • Fix · CNA ibi (SanDisk) Fixed in 9.4.0-191
  • Fix · CNA My Cloud OS 5 (Western Digital) Fixed in 5.26.202

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SanDisk ibi 9.4.0-191

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-16675 Path Traversal Vulnerability leading to an arbitrary file read in Western Digital devicesPriority LOW 27
    • TI-2022-16673 Resource Exhaustion Vulnerability in Western Digital devicesPriority LOW 23
    Show all 3 records →
  • Release ·

    Western Digital My Cloud Home and My Cloud Home Duo, My Cloud OS 5 5.26.202, 9.4.0-191

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-16675 Path Traversal Vulnerability leading to an arbitrary file read in Western Digital devicesPriority LOW 27
    • TI-2022-16673 Resource Exhaustion Vulnerability in Western Digital devicesPriority LOW 23
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36327
  2. 2026-10-03 Alias added: GHSA-w8xh-67qr-h5gr

References

Advisory 2

  • TI-2016-08187 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
  • TI-2018-12259 It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by… CVSS 3.0CRITICAL 9.8
  • TI-2022-12204 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp CVSS 3.1CRITICAL 9.8
  • TI-2016-08186 Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud… CVSS 3.0CRITICAL 9.8
  • TI-2018-01067 Memory corruption in Western Digital TV Media Player CVSS 3.0CRITICAL 9.8
  • TI-2022-12202 Command Injection Vulnerability in Western Digital My Cloud devices CVSS 3.1CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences