What’s Vulnerable › Vulnerabilities

CVE-2022-37706

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-25 · updated 2026-06-17
• Weakness: CWE-269

Description

enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.

Affected products

• Enlightenment: before 0.25.4 — fixed in 0.25.4

How to fix

Upgrade to a fixed version: Enlightenment 0.25.4. Check the vendor advisory for mitigations.

References

• https://git.enlightenment.org/enlightenment/enlightenment/commit/cae78cbb169f237862faef123e4abaf63a1f5064
• https://git.enlightenment.org/enlightenment/enlightenment/commit/cc7faeccf77fef8b0ae70e312a21e4cde087e141
• https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit
• https://git.enlightenment.org/enlightenment/enlightenment/commit/cae78cbb169f237862faef123e4abaf63a1f5064
• https://git.enlightenment.org/enlightenment/enlightenment/commit/cc7faeccf77fef8b0ae70e312a21e4cde087e141
• https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit

Get alerted when CVE-2022-37706 or the next vulnerability affects your stack