CVE-2022-27617 Path traversal in Synology Calendar

What is CVE-2022-27617?

CVE-2022-27617 is a medium-severity path traversal vulnerability in Synology Calendar, published on 3 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to download arbitrary files via unspecified vectors.

Weakness: CWE-22

Which versions are affected by CVE-2022-27617?

It affects 1 product.

Products include Synology Calendar.

How do I fix CVE-2022-27617?

No fix has been published for CVE-2022-27617 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-27617 being exploited?

There is no known exploitation of CVE-2022-27617 in the wild and no public exploit code.

Other vulnerabilities in Synology Calendar

• CVE-2019-11829 Command injection in Calendar High 7.3
• CVE-2022-22686 Cross-site request forgery in Synology Calendar Medium 6.5
• CVE-2022-22682 Cross-site scripting in Synology Calendar Medium 6.5
• CVE-2019-11825 Cross-site scripting in Calendar Medium 6.5
• CVE-2018-8915 Cross-site scripting in Calendar Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fqf3-wwvm-vgr9.