Apache DolphinScheduler vulnerable to Path Traversal

CVE-2022-34662 · Published Nov 1, 2022 · updated May 6, 2025

Medium6.5

Fix: upgrade to 3.0.0 or later

When users add resources to the resource center with a relation path, this vulnerability will cause path traversal issues for logged-in users. Users should upgrade to version 3.0.0 to avoid this issue.

Affected versions

Package	Affected	Fixed in
org.apache.dolphinscheduler:dolphinscheduler Maven	< 3.0.0	3.0.0

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-22
Also known as: CVE-2022-34662

More dolphinscheduler advisories

All dolphinscheduler

Critical 9.8Feb 20, 2024

Remote Code Execution in Apache DolphinschedulerCVE-2023-49109fixed in 3.2.1 High 7.5Nov 24, 2023

Apache DolphinScheduler sensitive information disclosureCVE-2023-48796fixed in 3.0.2 Critical 9.8Jan 4, 2023

Apache DolphinScheduler vulnerable to Improper Input ValidationCVE-2022-45875fixed in 3.0.2 +1 Medium 6.5Oct 28, 2022

Apache DolphinScheduler vulnerable to Path TraversalCVE-2022-26884fixed in 2.0.6 High 7.5Mar 31, 2022

Uncontrolled Resource Consumption in Apache DolphinSchedulerCVE-2022-25598fixed in 2.0.5 Critical 9.8Feb 9, 2022

Remote code execution in DolphinSchedulerCVE-2020-11974fixed in 1.3.0