Read the docs
TI-2022-22801 Aliases CVE-2022-46157GHSA-w9wc-4xcq-8gr6

Remote php code execution in Akeneo PIM

Priority HIGH 73CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows remote authenticated users to execute arbitrary PHP code on the server by uploading a crafted image. Akeneo PIM Community Edition after the versions aforementioned provides patched Apache HTTP server configuration file, for docker setup and in documentation sample, to fix this vulnerability. Community Edition users must change their Apache HTTP server configuration accordingly to be protected. The patch for Cloud Based Akeneo PIM Services customers has been applied since 30th October 2022. Users are advised to upgrade. Users unable to upgrade may Replace any reference to `<FilesMatch \.php$>` in their apache httpd configurations with: `<Location "/index.php">`.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01501 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pim-community-dev (akeneo): 6.0.53, 5.0.119akeneo/pim-community-dev (Packagist): 6.0.53, 5.0.119

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
akeneopim-community-dev6.0.0 to before 6.0.53; before 5.0.1196.0.53, 5.0.119Patch availableCNA
—akeneo/pim-community-dev (Packagist)6.0.0 to before 6.0.536.0.53Patch availableGHSA-w9wc-4xcq-8gr6
—akeneo/pim-community-dev (Packagist)before 5.0.1195.0.119Patch availableGHSA-w9wc-4xcq-8gr6
  • pim-community-dev Vendorakeneo Affected 6.0.0 to before 6.0.53; before 5.0.119 Fixed in 6.0.53, 5.0.119 Patch available CNA
  • akeneo/pim-community-dev (Packagist) Vendor— Affected 6.0.0 to before 6.0.53 Fixed in 6.0.53 Patch available GHSA-w9wc-4xcq-8gr6
  • akeneo/pim-community-dev (Packagist) Vendor— Affected before 5.0.119 Fixed in 5.0.119 Patch available GHSA-w9wc-4xcq-8gr6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:akeneo:product_information_management:*:*:*:*:community:*:*:*before 5.0.119; 6.0.0 to before 6.0.53Vulnerableakeneo
  • cpe:2.3:a:akeneo:product_information_management:*:*:*:*:community:*:*:* Versions before 5.0.119; 6.0.0 to before 6.0.53 Vulnerable ·akeneo

Remediation

  • Fix · CNA pim-community-dev (akeneo) Fixed in 6.0.53, 5.0.119
  • Fix · GHSA-w9wc-4xcq-8gr6 akeneo/pim-community-dev (Packagist) Fixed in 6.0.53 Advisory →
  • Fix · GHSA-w9wc-4xcq-8gr6 akeneo/pim-community-dev (Packagist) Fixed in 5.0.119 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-46157
  2. 2026-10-03 Alias added: GHSA-w9wc-4xcq-8gr6

References

Exploit 1

Advisory 2

Other 2

  • TI-2017-14356 Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences