CVE-2022-45134 Deserialization in n/a
An attacker can execute arbitrary code by uploading a malicious XML file during the skin import process in Mahara.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-45134?
CVE-2022-45134 is a critical unsafe deserialization vulnerability in Mahara Mahara, published on 22 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import. A particularly structured XML file could cause code execution when being processed.
Weakness: CWE-502
Which versions are affected by CVE-2022-45134?
It affects 1 product.
Products include Mahara Mahara.
How do I fix CVE-2022-45134?
No fix has been published for CVE-2022-45134 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-45134 being exploited?
There is no known exploitation of CVE-2022-45134 in the wild and no public exploit code.
Other vulnerabilities in Mahara Mahara
Sources
Also known as GHSA-77p7-jp5j-xxqj.