ZK Framework AuUploader Component Sensitive Information Disclosure and RCE Vulnerability (CVE-2022-36537)
Executive & SecOps Summary
SECOPS ASSESSMENTZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, 8.6.4.1, and prior
Unauthenticated attackers can access sensitive system files and class resources via crafted POST requests, potentially leading to Remote Code Execution (RCE).
Immediately upgrade ZK Framework to patched versions (9.6.2, 9.6.0.2, 9.5.1.4, 9.0.1.3, 8.6.4.2 or later) and block suspicious AuUploader requests via WAF.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update the ZK Framework dependency version in your build configuration file (e.g., Maven pom.xml) to the patched version (9.6.2 or higher) and rebuild the application.
<!-- Update Maven pom.xml dependencies -->
<dependency>
<groupId>org.zkoss.zk</groupId>
<artifactId>zk</artifactId>
<version>9.6.2</version>
</dependency>
<dependency>
<groupId>org.zkoss.zk</groupId>
<artifactId>zul</artifactId>
<version>9.6.2</version>
</dependency>2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, configure your Web Application Firewall (WAF) or reverse proxy to block suspicious requests targeting the AuUploader component.
# Nginx configuration to block suspicious AuUploader requests
location ~* /zkau.*AuUploader {
cond_pattern 'nextURI=';
deny all;
return 403;
}3. Log Audit & IoC Verification Commands
Scan your application server access logs to identify potential exploitation attempts targeting the AuUploader endpoint.
# Search access logs for suspicious POST requests containing AuUploader
grep -i 'AuUploader' /var/log/nginx/access.log | grep -E 'POST|nextURI'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the 'AuUploader' component of ZK Framework, a popular Java-based web framework. Due to insufficient input validation and improper resource handling within the AuUploader servlet, unauthenticated remote attackers can bypass access controls to retrieve sensitive classpath resources and configuration files from the server.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a specially crafted HTTP POST request targeting the ZK asynchronous update endpoint (typically '/zkau') with parameters directed at the AuUploader component. By manipulating these parameters, the attacker forces the framework's resource loader to expose internal XML configurations, Java class bytecodes, or other sensitive deployment descriptors. In active exploitation scenarios, this information disclosure is chained with other deserialization or configuration exploits to achieve full Remote Code Execution (RCE).
3. Infrastructure & Business Impact
As this vulnerability is listed in the CISA KEV catalog, it is actively being exploited in the wild. Successful exploitation allows attackers to harvest database credentials, API keys, and proprietary source code. This can lead to severe data breaches, lateral movement within the internal network, and complete compromise of the hosting infrastructure.
Official Vendor Advisories & References
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
Frequently Asked SecOps Questions (CVE-2022-36537)
FAQQ1. How critical is CVE-2022-36537 and is it actively exploited in the wild?
CVE-2022-36537 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 95.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-36537?
Primary impacted vendors include potix across zk_framework. Scope summary: ZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, 8.6.4.1 and all prior unpatched versions
Q3. What temporary mitigations or workarounds exist for CVE-2022-36537 before patching?
[Mitigation] Immediately upgrade ZK Framework to patched versions (9.6.2, 9.6.0.2, 9.5.1.4, 9.0.1.3, 8.6.4.2 or later) and block suspicious AuUploader requests via WAF. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-36537
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (potix)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.