Skip to content
OpenAdvisories
Medium · 4.3 CVE-2022-40309 EUVD-2022-7463GHSA-xgq8-jq9w-77r5

Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories

Published Nov 15, 2022 · Updated Apr 30, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Archiva Package: org.apache.archiva:archiva-common Ecosystem: Maven

Description

Users with write permissions to a repository can delete arbitrary directories.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Archiva unspecified – ≤ 2.2.8 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.archiva:archiva-common < 2.2.9 2.2.9 GHSA-xgq8-jq9w-77r5

References