CVE-2022-37422: Payara

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded.

Affected products

• Payara Payara: before 4.1.2.191.36 (fixed in 4.1.2.191.36); before 5.2022.3 (fixed in 5.2022.3); from 5.0.0, before 5.42.0 (fixed in 5.42.0)

Published 2022-08-18. Last modified 2026-06-17.