CVE-2022-48253

nhttpd in Nostromo before 2.1 is vulnerable to a path traversal that may allow an attacker to execute arbitrary commands on the remote server. The vulnerability occurs when the homedirs option is used.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.41% chance of exploitation in the next 30 days, 89th percentile

Nuclei

critical

Published

2023-01-11

Updated

2025-04-08

Proof-of-concept exploits (1)

• https://www.soteritsecurity.com/blog/2023/01/nostromo_from_directory_traversal_to_RCE.html

Nuclei templates (1)

• linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2022-48253.yaml

Exploit collections (1)

• CVE-2022-48253.yamlzan8in/afrog

Security advisories

• https://nazgul.ch/dev/nostromo_cl.txt

References

• CVE Record
• NVD entry