CVE-2022-33913: Mahara

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission check.

Affected products

• Mahara Mahara: from 21.04.0, before 21.04.6 (fixed in 21.04.6); from 21.10.0, before 21.10.4 (fixed in 21.10.4); version 22.04.2 only

Published 2022-06-20. Last modified 2026-06-17.