FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or…
Priority MEDIUM 40CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00736 54th percentileScored 2026-11-07
Fix Fixed io.fusionauth:fusionauth-java-client (Maven): 1.41.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | io.fusionauth:fusionauth-java-client (Maven) | 1.37.0 to before 1.41.3 | 1.41.3 | Patch available | GHSA-rmcx-fg5w-x8j9 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- io.fusionauth:fusionauth-java-client (Maven) Vendor— Affected 1.37.0 to before 1.41.3 Fixed in 1.41.3 Patch available GHSA-rmcx-fg5w-x8j9
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fusionauth:fusionauth:*:*:*:*:*:*:*:* | 1.37.0 to before 1.41.3 | Vulnerable | Fusionauth |
- cpe:2.3:a:fusionauth:fusionauth:*:*:*:*:*:*:*:* Versions 1.37.0 to before 1.41.3 Vulnerable ·Fusionauth
Remediation
- Fix · GHSA-rmcx-fg5w-x8j9 io.fusionauth:fusionauth-java-client (Maven) Fixed in 1.41.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-45921
- 2026-10-03 Alias added: GHSA-rmcx-fg5w-x8j9
References
More Fusionauth vulnerabilities
- TI-2020-06313 An issue was discovered in FusionAuth before 1.11.0. CVSS 3.1HIGH 7.2
Sources
- CVE-2022-45921 · CVE Program
- CVE-2022-45921 · NVD
- FIRST EPSS
- GHSA-rmcx-fg5w-x8j9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences