CVE-2022-23470
CVE-2022-23470 is a high-severity vulnerability in Galaxyproject Galaxy with a CVSS 3.x base score of 8.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-22.
Key facts
- Severity: High (CVSS 3.x base score 8.6)
- EPSS exploit prediction: 1% (52nd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-22
- Affected product: Galaxyproject Galaxy
- Published:
- Last modified:
Description
Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and higher, after the switch to gunicorn, which serve static contents directly. Additionally, the vulnerability is mitigated when using Nginx or Apache to serve /static/* contents, instead of Galaxy's internal middleware. This issue has been patched in commit `e5e6bda4f` and will be included in future releases. Users are advised to manually patch their installations. There are no known workarounds for this vulnerability.
Frequently asked questions
- What is CVE-2022-23470?
- Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and higher, after the switch to gunicorn, which serve static contents directly. Additionally, the vulnerability is mitigated when using Nginx or Apache to serve /static/* contents, instead of Galaxy's internal middleware. This issue has been patched in commit `e5e6bda4f` and will be included in future releases. Users are advised to manually patch their installations. There are no known workarounds for this vulnerability.
- How severe is CVE-2022-23470?
- CVE-2022-23470 has a CVSS 3.x base score of 8.6, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2022-23470 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (52nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-23470?
- CVE-2022-23470 affects Galaxyproject Galaxy. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2022-23470?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2022-23470 published?
- CVE-2022-23470 was published on 2022-12-06 and last updated on 2026-06-17.
References
- https://github.com/galaxyproject/galaxy/commit/e5e6bda4f014f807ca77ee0cf6af777a55918346
- https://github.com/galaxyproject/galaxy/security/advisories/GHSA-grjf-2ghx-q77x
Affected products (1)
- cpe:2.3:a:galaxyproject:galaxy:*:*:*:*:*:*:*:*
More vulnerabilities in Galaxyproject Galaxy
- CVE-2023-27578 — Critical (CVSS 9.1): Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01,…
- CVE-2024-42346 — High (CVSS 7.6): Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools,…
- CVE-2024-42351 — Medium (CVSS 6.5): Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools,…
- CVE-2023-42812 — Medium (CVSS 6.3): Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side…
- CVE-2018-1000516 — Medium (CVSS 6.1): The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation…
- CVE-2015-10062 — Medium (CVSS 5.5): A vulnerability, which was classified as problematic, was found in galaxy-data-resource up to 14.10.0. This affects an…
All CVEs affecting Galaxyproject Galaxy →
Other CWE-22 (Path Traversal) vulnerabilities
- CVE-2026-48282 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted…
- CVE-2026-54917 — Critical (CVSS 10.0): SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the…
- CVE-2026-11429 — Critical (CVSS 10.0): Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file…
- CVE-2026-34909 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to…
- CVE-2026-7411 — Critical (CVSS 10.0): In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel…
- CVE-2026-36767 — Critical (CVSS 10.0): A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary…