CVE-2022-42707: Mahara

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permission check under certain conditions.

Affected products

• Mahara Mahara: from 21.04.0, before 21.04.7 (fixed in 21.04.7); from 21.10.0, before 21.10.5 (fixed in 21.10.5); from 22.04.0, before 22.04.3 (fixed in 22.04.3); version 22.10.0 only

Published 2022-11-06. Last modified 2026-06-17.