CVE-2022-22909: HotelDruid room name field code injection allows RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw is network-reachable, leads to full RCE, has a public exploit and a very high EPSS score, though it requires an authenticated low-privileged account and is not in KEV.

What it is

HotelDruid v3.0.3 contains a code injection flaw in the Create New Room module, where a crafted payload placed in the name field leads to remote code execution. Because the injected code runs on the server, an attacker with a valid account can execute arbitrary commands within the application's context.

Impact

An attacker gains remote code execution on the HotelDruid server, allowing arbitrary command execution and full compromise of the application and its data. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network through the Create New Room module; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so an authenticated low-privileged user is needed.

Exploitation

A public exploit reference exists on GitHub, and EPSS is 0.45434 (98.7th percentile), indicating high predicted exploitation activity; the CVE is not listed in CISA KEV, so no confirmed in-the-wild use is documented.

What to do

• Upgrade HotelDruid to a version later than 3.0.3 if the vendor provides a fix; verify against the vendor advisory at hoteldruid.com.
• Restrict access to the Create New Room module and other administrative functions to trusted accounts only.
• Apply input validation and output encoding to the room name field, and avoid evaluating user-supplied values as code.
• Monitor and limit the privileges of accounts that can create rooms, and review existing room names for suspicious payloads.

Detection

• Search web and application logs for requests to the Create New Room endpoint containing code-like or template syntax in the name parameter.
• Alert on unexpected child processes or command execution spawned by the web server user.
• Review HotelDruid room records for names containing unusual characters, delimiters or function-like strings.
• Correlate authentication events for low-privileged accounts with subsequent room creation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.