CVE-2022-28945

Critical · CVSS 9.8

WeBankPartners wecube-platform — Directory Traversal via Zip Slip (CWE-22)

CVSS: 9.8; nvd
EPSS: 2.00%; 78th pct
KEV: No
Class: oss containerizable; CWE-22

Description

An issue in Webbank WeCube v3.2.2 allows attackers to execute a directory traversal via a crafted ZIP file.

Search profile — drives PoC discovery

Symbols ZipFileZipEntrygetInputStreamextractZipzipSlipFile.separatorgetCanonicalPathwecube-platformplugin package uploadZIP extraction

Keywords CVE-2022-28945WeCube directory traversalwecube-platform zip slipWeBankPartners wecube zip traversalWeCube v3.2.2 path traversalwecube crafted ZIP exploitwecube-platform issue 2324

Versions: ≤ v3.2.2

References

https://github.com/WeBankPartners/wecube-platform/issues/2324
https://github.com/WeBankPartners/wecube-platform/releases/tag/v3.2.2
http://webbank.com
http://wecube.com
https://github.com/WeBankPartners/wecube-platform/issues/2324
https://github.com/WeBankPartners/wecube-platform/releases/tag/v3.2.2

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T12:30:39.000Z