Path Traversal Vulnerability in Penta Security WAPPLES Web Application Firewall
CVE-2022-51025

7.1HIGH

Key Information:

Vendor

Penta Security Systems

Status
Wapples
Vendor
CVE Published:
22 October 2026

What is CVE-2022-51025?

Penta Security WAPPLES versions 4.0.54.1, 5.0, and 6.0 are susceptible to a path traversal vulnerability that enables authenticated attackers to download arbitrary files by manipulating the 'name' parameter in webapi/file/transfer. By sending specially crafted GET requests while using backend sequences like '../', attackers can access sensitive files, such as /etc/passwd. The presence of a hardcoded systemi account further simplifies the authentication process, making exploitation feasible. This vulnerability was first reported by the Shadowserver Foundation on October 19, 2023.

Affected Version(s)

WAPPLES 4.0.54.1

WAPPLES 5.0

WAPPLES 6.0

References

https://medium.com/@_sadshade/wapples-web-application-fir...
technical-descriptionexploit
https://github.com/projectdiscovery/nuclei-templates/blob...
technical-description
https://www.pentasecurity.com/product/wapples/
product

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Shadowserver Foundation
.