Apache DolphinScheduler prior to 3.0.0 allows path traversal

Vulnerability

Description CVE-2022-34662 is a path traversal vulnerability in Apache DolphinScheduler versions prior to 3.0.0. The root cause is insufficient validation of the relation path parameter when users add resources to the resource center, allowing directory traversal attacks [1][3].

Exploitation

Conditions The vulnerability is exploitable only by authenticated users, meaning an attacker must have valid login credentials to the DolphinScheduler web interface. No special privileges beyond being logged in are required; the attacker can craft a malicious relation path when adding a resource to traverse directories outside the intended scope [1][3].

Impact

Successful exploitation could allow an attacker to read or write files outside the designated resource directory, potentially leading to unauthorized access to sensitive configuration files, data, or other system resources. The exact impact depends on the file system permissions and the context of the DolphinScheduler installation [1][3].

Mitigation

The vulnerability is fixed in Apache DolphinScheduler version 3.0.0 and later. Users are strongly advised to upgrade to the latest version. No official workaround is documented, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog [1][3].