High severity · published Dec 23, 2022
CVE-2022-46171
Tauri is a framework for building binaries for all major desktop platforms
7.7
CVSS
1.1%
EPSS
No
On KEV
Description
Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Tauri · Tauri
1.0.0 before 1.0.8; 1.1.0 before 1.1.3; 1.2.0 before 1.2.3; 2.0.0; 2.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-46171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-46171
Patch
https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3
Patch
https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58
Exploit
https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5
More from Tauri
9.8
CVE-2023-34460
Tauri is a framework for building binaries for all major desktop platforms
8.8
CVE-2026-42184
Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands
8.3
CVE-2026-95626
Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains
5.9
CVE-2024-35222
iFrames Bypass Origin Checks for Tauri API Access Control
5.8
CVE-2022-39215
Tauri is a framework for building binaries for all major desktop platforms
