CVE-2022-34662

Apache DolphinScheduler prior to 3.0.0 allows path traversal

When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher

Affected

Apache Software Foundation · Apache DolphinScheduler

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

1.56% chance of exploitation in the next 30 days, 75th percentile

Published

2022-11-01

Updated

2025-05-06

Proof-of-concept exploits (1)

• shoucheng3/apache__dolphinscheduler_CVE-2022-34662_2-0-90★ · 2025-08-20

Security advisories

• https://lists.apache.org/thread/pbdzqf9ntxyvs4cr0x2dgk9zlf43btz8
• advisories/GHSA-fp35-xrrr-3gph

References

• CVE Record
• NVD entry