CVE-2022-29517: Lansweeper HelpdeskActions.aspx path traversal enables arbitrary file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with low privileges and no user interaction, plus a high EPSS score and public exploit reference, make this a serious risk despite no KEV listing.

What it is

Lansweeper 10.1.1.0 contains a directory traversal flaw in the HelpdeskActions.aspx edittemplate functionality. A crafted HTTP request can traverse paths and upload arbitrary files, which matters because file upload on a management platform can lead to code execution or full compromise.

Impact

An authenticated attacker can write arbitrary files to locations of their choosing on the server, potentially achieving remote code execution or overwriting application content.

Attack surface

Reached over the network via HTTP requests to HelpdeskActions.aspx; the CVSS vector indicates low privileges are required and no user interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.576 (99th percentile) and the Talos reference is tagged Exploit, indicating public exploit detail exists.

What to do

• Upgrade Lansweeper to a version that fixes the edittemplate path traversal; the record does not name a fixed version, so confirm with the vendor.
• Restrict network access to the Lansweeper web interface to trusted management networks.
• Enforce least privilege on accounts that can reach HelpdeskActions.aspx and review who holds those roles.
• Validate and normalize file paths server-side and block traversal sequences in upload handling.
• Monitor the upload directory for unexpected file types or newly written files.

Detection

• Alert on HTTP requests to HelpdeskActions.aspx containing traversal sequences such as ../ or encoded variants.
• Monitor the Lansweeper upload/template directories for new or modified files outside normal change windows.
• Review web server logs for POST requests to edittemplate functionality from unusual source addresses.
• Correlate file writes in web-accessible paths with subsequent process execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.