CVE-2022-44016: Simmeth Lieferantenmanager

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LM_API/api/ConfigurationService/GetImages with an '"ImagesPath":"C:\\"' value.

Affected products

• Simmeth Lieferantenmanager: before 5.6 (fixed in 5.6)

Published 2022-12-25. Last modified 2026-06-17.