What’s Vulnerable › Vulnerabilities

CVE-2022-50992: Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-30 · updated 2026-06-17
• Weakness: CWE-22

Description

Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods. Attackers can exploit these methods without authentication to retrieve sensitive files including system configuration files and database credentials from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-12-14 (UTC).

Affected products

• Weaver Network Co., Ltd. E-cology: before 10.52 — fixed in 10.52

How to fix

Upgrade to a fixed version: Weaver Network Co., Ltd. E-cology 10.52. Check the vendor advisory for mitigations.

References

• https://blog.csdn.net/qq_36618918/article/details/135104295
• https://blog.csdn.net/xiayu729100940/article/details/135205082
• https://www.cnvd.org.cn/flaw/show/CNVD-2022-43245
• https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-arbitrary-file-read-via-xmlrpcservlet
• https://www.weaver.com.cn/cs/ecology_full_log.html
• https://www.weaver.com.cn/cs/securityDownload.html#

Get alerted when CVE-2022-50992 or the next vulnerability affects your stack