CVE-2022-36327

9.8 criticalEPSS 1.5%

Critical (9.8) in westerndigital. EPSS 1.5% chance of exploitation in the next 30 days.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to remote code execution was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires an authentication bypass issue to be triggered before this can be exploited. This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2023-05-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

westerndigital:my_cloud_home_duo_firmware
westerndigital:my_cloud_home_firmware
westerndigital:my_cloud_os_5
westerndigital:sandisk_ibi_firmware

References

Check your stack JSON