CVE-2022-34866: Yrl Passage Drive

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running.

Affected products

• Yrl Passage Drive: from 1.4.0, up to and including 1.5.1.0
• Yrl Passage Drive For Box: version 1.0.0 only

Published 2022-07-20. Last modified 2026-06-17.