CVE-2022-4768

9.8 criticalEPSS 0.7%

A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of the component SSH Public Key Handler. The manipulation of the argument public_key_str leads to injection. It is possible to launch the attack remotely. The name of the patch is d93087973afa26bc0a2d0a5eb5c0fde748bdd107. It is recommended to apply a patch to fix this issue. VDB-216906 is the identifier assigned to this vulnerability.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2022-12-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dropbox:merou

References

https://github.com/dropbox/merou/commit/d93087973afa26bc0a2d0a5eb5c0fde748bdd107
https://github.com/dropbox/merou/pull/673
https://vuldb.com/?ctiid.216906
https://vuldb.com/?id.216906
https://github.com/dropbox/merou/commit/d93087973afa26bc0a2d0a5eb5c0fde748bdd107

Check your stack JSON