PT-2022-27659 · Percona · Percona Xtrabackup

Chaloff · Published 2022-11-23 · Updated 2025-04-25 · CVE-2022-45866

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions qpress versions before 11.3 qpress before PierreLvx/qpress 20220819

Description The issue allows directory traversal via ../ in a .qp file. This can be exploited in products that use qpress, such as Percona XtraBackup.

Recommendations For qpress versions before 11.3, update to version 11.3 or later. For qpress before PierreLvx/qpress 20220819, update to PierreLvx/qpress 20220819 or later. As a temporary workaround, consider restricting access to .qp files to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-45866

Affected Products

Percona Xtrabackup

References · 13

• 🔥 https://github.com/percona/percona-xtrabackup/pull/1366 · Exploit
• 🔥 https://github.com/PierreLvx/qpress/pull/6 · Exploit
• https://github.com/PierreLvx/qpress/compare/20170415...20220819 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-45866 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4RXO3VYIFRTNIFHWIAZWND6ZXQ5OYOB · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45866 · Vendor Advisory
• https://github.com/EvgeniyPatlan/qpress/commit/ddb312090ebd5794e81bc6fb1dfb4e79eda48761 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQWF7635AJSDKEIGLB73XAH643POGTFY · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUZ73XT2FXLHC7I4ODLOVB4O4QN7Q7JB · Vendor Advisory
• https://t.me/cvenotify/39095 · Telegram Post
• https://t.me/cvenotify/38372 · Telegram Post
• https://t.me/cvenotify/119850 · Telegram Post
• https://pkgs.org/download/qpress · Note