CVE-2022-46157

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows remote authenticated users to execute arbitrary PHP code on the server by uploading a crafted image. Akeneo PIM Community Edition after the versions aforementioned provides patched Apache HTTP server configuration file, for docker setup and in documentation sample, to fix this vulnerability. Community Edition users must change their Apache HTTP server configuration accordingly to be protected. The patch for Cloud Based Akeneo PIM Services customers has been applied since 30th October 2022. Users are advised to upgrade. Users unable to upgrade may Replace any reference to `<FilesMatch \.php$>` in their apache httpd configurations with: `<Location "/index.php">`.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Dec 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-461584.3PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. UserCVE-2022-461594.3Discourse is an open-source discussion platform. In version 2.8.13 and prior on the `stable` branch and version 2.9.0.beta14 and prior on thCVE-2022-46169.1The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerabiCVE-2022-461604.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.104, project lCVE-2022-461619.8pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsaCVE-2022-461629.8discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generaCVE-2022-461637.5Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, paCVE-2022-461649.8NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a speCVE-2022-461655.4Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared foldersCVE-2022-461669.8Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring BootCVE-2022-461678.8Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant NamespacCVE-2022-461683.5Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and
CVE-2022-46157: High severity, CVSS 8.8 | Vulnix