CVE-2022-23470 Arbitrary file access in the Galaxy data analysis platform

High 8.6 Published 6 Dec 2022 Updated 23 Apr 2025

Attackers can read arbitrary files on the server due to improper static file handling in Galaxy's Gunicorn configuration.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-23470?

CVE-2022-23470 is a high-severity path traversal vulnerability in galaxyproject galaxy, published on 6 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and higher, after the switch to gunicorn, which serve static contents directly. Additionally, the vulnerability is mitigated when using Nginx or Apache to serve /static/* contents, instead of Galaxy's internal middleware. This issue has been patched in commit `e5e6bda4f` and will be included in future releases. Users are advised to manually patch their installations. There are no known workarounds for this vulnerability.

Weakness: CWE-22

Which versions are affected by CVE-2022-23470?

It affects 1 product.

Products include Galaxyproject Galaxy.

How do I fix CVE-2022-23470?

No fix has been published for CVE-2022-23470 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-23470 being exploited?

There is no known exploitation of CVE-2022-23470 in the wild and no public exploit code.

Sources

Also known as GHSA-grjf-2ghx-q77x.