CVE-2022-4778: path traversal in elvexys StreamX using StreamView HTML component with public web server feature

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-29 · updated 2026-06-17
Weakness: CWE-22

Description

StreamX applications from versions 6.02.01 to 6.04.34 are affected by a path traversal vulnerability that allows authenticated users to get unauthorized access to files on the server's filesystem. StreamX applications using StreamView HTML component with the public web server feature activated are affected.

Affected products

elvexys StreamX: from 6.02.01 through 6.04.34

References

https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/streamx-release-notes/
https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/streamx-release-notes/

Get alerted when CVE-2022-4778 or the next vulnerability affects your stack