CVE-2022-47747 Kraken has arbitrary file read vulnerability via component testfs

Q: Which versions are affected by CVE-2022-47747?

3 open source packages ship an affected version, including github.com/uber/kraken. It affects 1 product.

Q: Is CVE-2022-47747 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-47747 exists.

Q: How do I fix CVE-2022-47747?

No fix has been published for CVE-2022-47747 yet. Limit exposure of the affected software until one is available.

High 7.5 Published 20 Jan 2023 Updated 3 Apr 2025

An attacker can read arbitrary files from the system via the testfs component in the kraken Go library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-47747?

CVE-2022-47747 is a high-severity path traversal vulnerability in n/a, published on 20 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.

Weakness: CWE-22

Which versions are affected by CVE-2022-47747?

3 open source packages ship an affected version, including github.com/uber/kraken. It affects 1 product.

Package	Affected	Fixed in
`github.com/uber/kraken` Go	All versions	None
`github.com/uber/kraken` Go	All versions to `0.1.4`	None
`github.com/uber/kraken` Go	All versions to `0.1.4`	None

Products include Uber Kraken.

How do I fix CVE-2022-47747?

No fix has been published for CVE-2022-47747 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-47747 being exploited?