CVE-2022-48253

nhttpd in Nostromo before 2.1 is vulnerable to a path traversal that may allow an attacker to execute arbitrary commands on the remote server. The vulnerability occurs when the homedirs option is used.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.41% chance of exploitation in the next 30 days, 88th percentile

Nuclei

critical

Published

2023-01-11

Updated

2025-04-08

Proof-of-concept exploits (1)

• https://www.soteritsecurity.com/blog/2023/01/nostromo_from_directory_traversal_to_RCE.html

Nuclei templates (1)

• linuxadi/40k-nuclei-templates/blob/main/aditya/folder1/CVE-2022-48253.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2022-48253.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-48252
• CVE-2022-4826
• CVE-2022-48251
• CVE-2022-4827
• CVE-2022-4825
• CVE-2022-4828