CVE-2022-2926 Download Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path Traversal

Q: What is CVE-2022-2926?

CVE-2022-2926 is a medium-severity path traversal vulnerability in Unknown Download Manager, published on 26 Sep 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Q: Is CVE-2022-2926 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2926 exists.

Q: How do I fix CVE-2022-2926?

No fix has been published for CVE-2022-2926 yet. Limit exposure of the affected software until one is available.

Medium 4.9 Published 26 Sep 2022 Updated 21 May 2025

Administrators can list and read arbitrary files outside the blog directory due to insufficient validation in the Download Manager plugin.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-2926?

CVE-2022-2926 is a medium-severity path traversal vulnerability in Unknown Download Manager, published on 26 Sep 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory

Weakness: CWE-22

Which versions are affected by CVE-2022-2926?

It affects 1 product.

Products include Adobe Download Manager.

How do I fix CVE-2022-2926?

No fix has been published for CVE-2022-2926 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-2926 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2926 exists.

Sources

Also known as GHSA-pr99-9g59-4vj9.