CVE-2022-44544: Mahara

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if the site is running on Ubuntu and the flag -dSAFER is not set with Ghostscript.

Affected products

• Mahara Mahara: from 21.04.0, before 21.04.7 (fixed in 21.04.7); from 21.10.0, before 21.10.5 (fixed in 21.10.5); from 22.04.0, before 22.04.3 (fixed in 22.04.3); version 22.10.0 only

Published 2022-11-06. Last modified 2026-06-17.