PT-2026-36125 · Fanwei · E-Cology

Published 2026-04-30 · Updated 2026-04-30 · CVE-2022-50992

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Weaver (Fanwei) E-cology versions 9.5 through 10.51

Description The XmlRpcServlet interface at the XML-RPC endpoint contains a flaw allowing unauthenticated remote attackers to read arbitrary files. This is achieved by providing file paths to the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods. Attackers can use these methods to retrieve sensitive information, such as database credentials and system configuration files, from the server. Evidence of exploitation was first observed on 2022-12-14 (UTC).

Recommendations Update to version 10.52 or later. As a temporary workaround, restrict access to the XML-RPC endpoint or disable the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-50992

Affected Products

E-Cology

References · 9

• 🔥 https://blog.csdn.net/xiayu729100940/article/details/135205082 · Exploit
• 🔥 https://blog.csdn.net/qq_36618918/article/details/135104295 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50992 · Security Note
• https://weaver.com.cn/cs/securityDownload.html# · Patch
• https://vulncheck.com/advisories/weaver-e-cology-unauthenticated-arbitrary-file-read-via-xmlrpcservlet · Note
• https://cnvd.org.cn/flaw/show/CNVD-2022-43245 · Note
• https://t.me/CVEtracker/52327 · Telegram Post
• https://weaver.com.cn/cs/ecology_full_log.html · Note
• https://twitter.com/CVEnew/status/2049913879203901928 · Twitter Post