Path traversal in Hadoop
Critical9.8CVE-2022-26612 · Published Apr 8, 2022 · updated Oct 1, 2025
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.hadoop:hadoop-common Maven | >= 3.2.0, < 3.2.3 | 3.2.3 |
| < 2.10.2 | 2.10.2 | |
| >= 3.3.0, < 3.3.3 | 3.3.3 |
Details and references
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 2.10.2, 3.2.3, 3.3.3, and 3.4.0.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2022-26612
- nvd.nist.gov/vuln/detail/CVE-2022-26612
- github.com/apache/hadoop
- github.com/apache/hadoop/commits/rel/release-2.10.2/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
- github.com/apache/hadoop/commits/rel/release-3.2.3/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
- github.com/apache/hadoop/commits/rel/release-3.3.3/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
- github.com/apache/hadoop/commits/rel/release-3.4.0/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java
- issues.apache.org/jira/browse/HADOOP-18317
- lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz
- security.netapp.com/advisory/ntap-20220519-0004
More Apache Hadoop advisories
All Apache Hadoop| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 132022 | Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop CVE-2016-5001Medium5.5fixed in 2.6.4, 2.7.2 | Medium5.5 | 2.6.4, 2.7.2 |
| May 142022 | Insecure Inherited Permissions in Apache Hadoop CVE-2016-6811High8.8fixed in 2.7.4 | High8.8 | 2.7.4 |
| May 172022 | Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation CVE-2017-7669High7.5fixed in 2.8.1, 3.0.0-alpha3 | High7.5 | 2.8.1, 3.0.0-alpha3 |
| May 172022 | Improper Authentication in Apache Hadoop CVE-2014-0229Medium6.5fixed in 0.23.11, 2.4.1 | Medium6.5 | 0.23.11, 2.4.1 |
| May 172022 | Improper Authentication in Apache Hadoop CVE-2013-2192Lowfixed in 0.23.9, 2.0.6-alpha | Low | 0.23.9, 2.0.6-alpha |
| May 172022 | Improper Access Control in Apache Hadoop CVE-2016-5393High8.8fixed in 2.6.5, 2.7.3 | High8.8 | 2.6.5, 2.7.3 |