CVE-2022-22932: Path traversal in Apache Karaf
Summary
CVE-2022-22932: Path traversal in Apache Karaf. Affects org.apache.karaf:apache-karaf across 2 version ranges.
< 4.2.15
>= 4.3.0, < 4.3.6
Fixed in 4.2.15 or 4.3.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Karaf is an open-source OSGi-based runtime container for deploying and managing applications. It provides a lightweight and flexible platform for building and running Java applications. The vulnerability in Apache Karaf allows for partial path traversal in the obr:* commands and run goal on the karaf-maven-plugin. While the risk is low as obr:* commands are not widely used and the entry is set by the user, it still poses a security concern.
Vulnerability Detail
The path traversal vulnerability in Apache Karaf's obr:* commands and run goal on the karaf-maven-plugin allows an attacker to break out of the expected folder. This can potentially lead to unauthorized access, data leakage, or remote code execution. However, the risk is mitigated by the fact that obr:* commands are not commonly used and the entry point is set by the user.
How To Fix
Latest published version: 4.4.12 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.2.154.2.15 -
>= 4.3.0, < 4.3.64.3.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to the patched versions of Apache Karaf or use the correct path when using the obr:* commands.
Conclusion
In conclusion, the path traversal vulnerability in Apache Karaf's obr:* commands and run goal on the karaf-maven-plugin can lead to unauthorized access, data leakage, or remote code execution. It is recommended that users upgrade to the latest patched versions of Apache Karaf or use the correct path when utilizing the obr:* commands. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.karaf:apache-karaf →
FAQ
Apache Karaf is an open-source OSGi-based runtime container for deploying and managing applications. It provides a lightweight and flexible platform for building and running Java applications.
The vulnerability allows for partial path traversal in Apache Karaf's obr:* commands and run goal on the karaf-maven-plugin. This can potentially lead to unauthorized access, data leakage, or remote code execution.
To fix this vulnerability, Apache Karaf users should upgrade to version 4.2.15 or 4.3.6 or later. Alternatively, users can ensure that the correct path is used when utilizing the obr:* commands.
There are no specific workarounds provided for this vulnerability. The recommended solution is to upgrade to the patched versions of Apache Karaf or use the correct path when using the obr:* commands.
The risk is considered low as obr:* commands are not widely used and the entry point is set by the user. However, it is still important to apply the necessary patches or upgrades to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.karaf:apache-karaf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
