CVE-2022-23166: Sysaid – Sysaid Local File Inclusion (LFI)

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-12 · updated 2026-06-17
Weakness: CWE-22

Description

Sysaid – Sysaid Local File Inclusion (LFI) – An unauthenticated attacker can access to the system by accessing to "/lib/tinymce/examples/index.html" path. in the "Insert/Edit Embedded Media" window Choose Type : iFrame and File/URL : [here is the LFI] Solution: Update to 22.2.20 cloud version, or to 22.1.64 on premise version.

Affected products

Sysaid: before 22.1.64; before 22.2.20 — fixed in 22.1.64, 22.2.20

How to fix

Upgrade to a fixed version: Sysaid 22.1.64, 22.2.20. Check the vendor advisory for mitigations.

References

https://www.gov.il/en/departments/faq/cve_advisories
https://www.gov.il/en/departments/faq/cve_advisories

Get alerted when CVE-2022-23166 or the next vulnerability affects your stack