CVE-2022-36537: ZK Framework information disclosure, exploited for RCE downstream
The short version: CVE-2022-36537 is an information-disclosure flaw in the ZK Framework — a Java/Ajax web framework embedded in many products. A crafted POST to the AuUploader component makes the server return files from the restricted WEB-INF directory (config, deployment descriptors, secrets). On its own it "just" leaks files; in the real world it was chained into remote code execution and ransomware against products like ConnectWise R1Soft. It's in CISA's KEV catalog. Steady hands: patch to the fixed branch build.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 95.3% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-03-20 |
| Known exploited? | Yes — known ransomware use; exploited in ConnectWise R1Soft Server Backup Manager for RCE + backdoors |
| Vulnerability type | Information disclosure (NVD: CWE-Other) → read of restricted internal files → chained to remote code execution |
| Requires authenticated session? | No — unauthenticated |
| Affected | ZK Framework 8.6.4.1, 9.0.1.2, 9.5.1.3, 9.6.0.1, 9.6.1 (and earlier releases) |
| Fixed in | 8.6.4.2 · 9.0.1.3 · 9.5.1.4 · 9.6.0.2 · 9.6.2 (and later) |
What you need to know
ZK is a framework other software is built on, so this flaw often shows up inside a product rather than as "ZK" on the label. The bug is in the AuUploader upload handler: a forged POST to the /zkau/upload endpoint that includes a nextURI parameter causes an internal forward, and the server returns whatever document that path points at — including files under the protected WEB-INF folder such as web.xml and zk.xml.
Why an "information disclosure" bug earns real attention:
- It's unauthenticated and easy to automate. No credentials, one crafted request — reflected in a very high EPSS.
- It leaks the keys to the next step. Deployment descriptors and config files often contain internal paths, secrets, and credentials that turn a read-only leak into a foothold.
- It was chained to full compromise. In ConnectWise R1Soft Server Backup Manager, attackers used this flaw to reach remote code execution and install backdoor drivers — and it's associated with known ransomware activity, which is why it's in KEV.
How serious we see it
High — above what "information disclosure" suggests on its own.
On paper the confidentiality-only vector (C:H/I:N/A:N) reads like a leak. In practice this was a stepping stone to RCE and ransomware in real products, it's unauthenticated and trivially automatable, and it's in CISA's KEV catalog. We rate it by how it actually gets used.
The bounded, reassuring part: it affects specific ZK branch versions, fixed builds are published for every affected branch, and you can determine exposure quickly — the main catch is remembering that ZK ships inside other products, so check those too.
Recommendations
Straight from the ZK security bulletin (ZK-5150) and CISA:
- Patch now. Upgrade ZK to the fixed build for your branch — 8.6.4.2 / 9.0.1.3 / 9.5.1.4 / 9.6.0.2 / 9.6.2 or later — and update any product that embeds ZK (e.g., apply the vendor's fixed release).
- If you can't patch immediately, restrict the component. Limit or block access to the
AuUploader//zkau/uploadendpoint; ZK's bulletin also documents a patch listener configuration for the interim. - Hunt for prior use. Review logs for POSTs to
/zkau/uploadwith anextURIparameter and for access toWEB-INFfiles; on affected products, look for signs of the downstream RCE. - If you find indicators, respond fully. Rotate any credentials and secrets that were reachable in the exposed config, and investigate for backdoors.
- Confirm your exposure first. Verify whether you run ZK — directly or bundled — at an affected version.
How BreachRisk sees it
BreachRisk discovers internet-facing applications built on ZK, fingerprints the version, and flags exposure tied to this KEV-listed flaw so it surfaces at the top of your results. Where verification is enabled, it goes a safe step beyond a scanner: it sends the crafted request sequence and checks the response for the tell-tale signs of a successful restricted-file read — confirming the exposure holds, as a benign check rather than a data grab.
That's the difference between "this looks like a vulnerable ZK build" and "we confirmed the AuUploader leak" — surfaced early, before it becomes step one of someone's ransomware intrusion.