CVE-2022-51025 in WAPPLES
Summary
by MITRE • 10/22/2026
Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Penta Security WAPPLES versions 4.0.54.1, 5.0, and 6.0 represents a critical security flaw rooted in improper input validation within the application's file transfer mechanism. Specifically, the /webapi/file/transfer endpoint fails to adequately sanitize or canonicalize user-supplied input passed via the name parameter. This lack of rigorous path normalization allows an attacker to manipulate the intended directory structure by injecting relative path traversal sequences, commonly known as dot-dot-slash or ../ characters. By appending these sequences to the filename argument, an authenticated actor can escape the designated upload or download directory and access arbitrary files located elsewhere on the server's file system. This type of flaw is classically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which highlights the failure to restrict user-controlled paths to intended locations.
The operational impact of this vulnerability is severe due to two compounding factors: trivial authentication and broad read access. The WAPPLES application contains a hardcoded systemi account with known credentials, effectively bypassing the need for complex credential guessing or brute-force attacks. This significantly lowers the barrier to entry for exploitation, allowing any actor aware of these default credentials to gain authenticated access. Once inside, the path traversal capability enables the reading of sensitive configuration files, such as /etc/passwd on Linux-based deployments, which can reveal user accounts and potentially aid in further lateral movement or privilege escalation attacks. The ability to download arbitrary system files compromises the confidentiality integrity of the entire environment hosting WAPPLES, potentially exposing database backups, application configurations, or other critical data depending on the file permissions granted to the service account running the web server.
From a threat intelligence perspective, this vulnerability has seen active exploitation in the wild. Evidence from the Shadowserver Foundation indicates that automated scanning and exploitation attempts were observed starting October 19, 2023. This real-world activity underscores the urgency of remediation, as attackers are actively targeting vulnerable instances to harvest sensitive data or establish persistent access points within corporate networks. The combination of default credentials and a straightforward path traversal exploit makes this vulnerability particularly dangerous in environments where WAPPLES is deployed without strict network segmentation or immediate patching protocols.
Mitigation strategies must address both the authentication weakness and the input validation flaw immediately. Organizations running affected versions should upgrade to the latest patched release provided by Penta Security, which includes fixes for the path traversal logic in the file transfer API. In cases where upgrading is not immediately feasible, administrators should disable or change the default systemi account credentials if possible, although removing hardcoded accounts entirely is preferred. Additionally, implementing a Web Application Firewall with rules capable of detecting and blocking HTTP requests containing ../ sequences in parameter values can provide an interim layer of defense. Network segmentation should also be reviewed to ensure that WAPPLES instances are not directly accessible from untrusted networks, limiting the attack surface available to potential adversaries. Continuous monitoring for anomalous file access patterns related to the /webapi/file/transfer endpoint is recommended to detect any ongoing exploitation attempts.