CVE-2022-26652: Linuxfoundation Nats-Server

Medium severity, CVSS 6.5. EPSS: 2.3% chance of exploitation in the next 30 days.

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.

Affected products

• Linuxfoundation Nats-Server: from 2.2.0, before 2.7.4 (fixed in 2.7.4)
• Nats Nats Streaming Server: from 0.15.0, before 0.24.3 (fixed in 0.24.3)

Published 2022-03-10. Last modified 2026-06-17.