CVE-2022-4880: openutau

csirt@kutim:~/threat-intel/cve/CVE-2022-4880

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada openutau. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in stakira OpenUtau. It has been classified as critical. This affects the function VoicebankInstaller of the file OpenUtau.Core/Classic/VoicebankInstaller.cs of the component ZIP Archive Handler. The manipulation leads to path traversal. Upgrading to version 0.0.991 is able to address this issue. The identifier of the patch is 849a0a6912aac8b1c28cc32aa1132a3140caff4a. It is recommended to upgrade the affected component. The identifier VDB-217617 was assigned to this vulnerability.

Rincian

Terbit di NVD: 7 Januari 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 1,1% peluang dieksploitasi; lebih tinggi dari 63,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
openutau	openutau	Semua versi sebelum 0.0.991

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/stakira/OpenUtau/commit/849a0a6912aac8b1c28cc32aa1132a3140caff4a patch
https://github.com/stakira/OpenUtau/pull/544 patch
https://vuldb.com/?id.217617 advisory pihak ketiga
https://github.com/stakira/OpenUtau/releases/tag/build%2F0.0.991 release notes
https://vuldb.com/?ctiid.217617 permissions required

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.