{"action":"Upgrade io.metersphere:metersphere to 2.5.1 or later.","affected":[{"fixed":"2.5.1","introduced":"0"}],"component":"io.metersphere:metersphere","cve_ids":["CVE-2022-46178"],"ecosystem":"Maven","epss":0.00724,"exploited":false,"fixed_versions":["2.5.1"],"ghsa_id":"GHSA-9p62-x3c5-hr5p","id":"tcs_01M5N8QDEVXD0W8G8GEH3EAD5C","modified_at":"2023-11-08T04:10:56.132181Z","published_at":"2022-12-30T18:03:47Z","references":["https://osv.dev/vulnerability/GHSA-9p62-x3c5-hr5p","https://github.com/metersphere/metersphere/security/advisories/GHSA-9p62-x3c5-hr5p","https://nvd.nist.gov/vuln/detail/CVE-2022-46178","https://github.com/metersphere/metersphere","https://github.com/metersphere/metersphere/blob/v2.5.0/framework/sdk-parent/sdk/src/main/java/io/metersphere/commons/utils/FileUtils.java#L5","https://github.com/metersphere/metersphere/releases/tag/v2.5.1"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-9p62-x3c5-hr5p","url":"https://osv.dev/vulnerability/GHSA-9p62-x3c5-hr5p"}],"summary":"Path Traversal In MeterSpere leads to upload file to any path"}