CVE-2022-44544

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-06 · updated 2026-06-17
Weakness: CWE-250

Description

Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if the site is running on Ubuntu and the flag -dSAFER is not set with Ghostscript.

Affected products

mahara: from 21.04.0 before 21.04.7; from 21.10.0 before 21.10.5; from 22.04.0 before 22.04.3; 22.10.0-rc1 — fixed in 21.04.7, 21.10.5, 22.04.3

How to fix

Upgrade to a fixed version: mahara 21.04.7, 21.10.5, 22.04.3. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/mahara/+bug/1979575
https://mahara.org/interaction/forum/topic.php?id=9198
https://bugs.launchpad.net/mahara/+bug/1979575
https://mahara.org/interaction/forum/topic.php?id=9198

Get alerted when CVE-2022-44544 or the next vulnerability affects your stack