CVE-2022-36537: ZK Framework AuUploader Unspecified Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: yes — in CISA KEV since 2023-02-27
EPSS: 95.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-26 · updated 2026-06-17

Description

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

Affected products

Zkoss Zk Framework: before 8.6.4.2; from 9.0.0 before 9.0.1.3; from 9.5.0 before 9.5.1.3; from 9.6.0 before 9.6.2 — fixed in 8.6.4.2, 9.0.1.3, 9.5.1.3, 9.6.2

How to fix

Upgrade to a fixed version: Zkoss Zk Framework 8.6.4.2, 9.0.1.3, 9.5.1.3, 9.6.2. Check the vendor advisory for mitigations.

References

https://tracker.zkoss.org/browse/ZK-5150
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/
https://tracker.zkoss.org/browse/ZK-5150
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36537

Get alerted when CVE-2022-36537 or the next vulnerability affects your stack