CVE-2022-26652

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-10 · updated 2026-06-17
Weakness: CWE-22

Description

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.

Affected products

nats-io nats-server: from 2.2.0 before 2.7.4 — fixed in 2.7.4
Nats Streaming Server: from 0.15.0 before 0.24.3 — fixed in 0.24.3

How to fix

Upgrade to a fixed version: nats-io nats-server 2.7.4; Nats Streaming Server 0.24.3. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2022/03/10/1
https://advisories.nats.io/CVE/CVE-2022-26652.txt
https://github.com/nats-io/nats-server/releases
https://github.com/nats-io/nats-server/security/advisories/GHSA-6h3m-36w8-hv68
http://www.openwall.com/lists/oss-security/2022/03/10/1
https://advisories.nats.io/CVE/CVE-2022-26652.txt
https://github.com/nats-io/nats-server/releases
https://github.com/nats-io/nats-server/security/advisories/GHSA-6h3m-36w8-hv68

Get alerted when CVE-2022-26652 or the next vulnerability affects your stack