CVE-2022-44635: Apache Fineract file upload path traversal enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityAuthenticated remote code execution with a high CVSS score of 8.8 and very high EPSS probability, though not yet in KEV.

What it is

Apache Fineract contains a path traversal flaw (CWE-22) in a file upload component that lets an authenticated user write files outside the intended directory and execute remote code. It affects version 1.8.0 and prior, with 1.8.1 as the fix. Because the platform handles core banking data, code execution on it is a serious risk.

Impact

An attacker with a valid account gains remote code execution on the Fineract server, leading to full compromise of confidentiality, integrity and availability of the application and its data.

Attack surface

Reached over the network through the file upload functionality of the web application; the attacker must be authenticated (CVSS PR:L) but no user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged, but EPSS is high at roughly 0.69 (99th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Apache Fineract to 1.8.1 or later immediately.
• If upgrade is not possible, restrict or disable the file upload feature and limit access to trusted accounts.
• Enforce strict allowlisting and path canonicalization on uploaded filenames, rejecting traversal sequences.
• Run Fineract with least privilege and isolate it so uploaded files cannot be executed.
• Audit accounts with upload permissions and remove unused or excessive privileges.

Detection

• Monitor file upload requests for path traversal sequences such as ../ or encoded variants in filenames or parameters.
• Alert on new or modified executable files appearing in web-accessible or application directories.
• Watch for unexpected child processes spawned by the Fineract application or web server user.
• Review application and web server logs for uploads followed by execution or out-of-directory file writes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.