CVE-2022-50890: Path Traversal in Owlfiles File Manager

The path traversal vulnerability in Owlfiles File Manager allows an attacker to bypass intended access restrictions and directly access files and directories on the device's file system. By crafting carefully designed GET requests containing directory traversal sequences (e.g., ../), an attacker can navigate outside the intended web application root and access arbitrary files. This could include sensitive configuration files, user data, or even system binaries. The potential impact ranges from information disclosure to potential remote code execution if the attacker can leverage the accessed files to compromise the device further. While direct code execution is not explicitly stated, the ability to access system files significantly increases the attack surface.

1. Reserved2026-01-10
2. Published2026-01-13
3. Modified2026-04-07
4. EPSS updated2026-03-23

The primary mitigation for CVE-2022-50890 is to upgrade Owlfiles File Manager to a patched version. Since a specific fixed version is not provided, it is crucial to monitor the vendor's official channels for updates. As a temporary workaround, restrict access to the file manager's HTTP server using a firewall or network segmentation. Consider implementing input validation and sanitization on all user-supplied input to prevent directory traversal attempts. Regularly review file system permissions to ensure that sensitive files are not accessible to unauthorized users or processes.