CVE-2022-36328

Path Traversal Vulnerability leading to an arbitrary file read in Western Digital devices

MEDIUM

4.9

CVSS Score

Published: May 18, 2023 at 05:55 PM UTC

Updated: June 17, 2026 at 04:53 AM UTC

18 products affected across 2 vendorsMy Cloud OS 5My Cloud Home FirmwareMy Cloud Home Duo Firmware

Using My Cloud Home and My Cloud Home Duo by Western Digital?

Get instant alerts when new vulnerabilities affect My Cloud Home and My Cloud Home Duo - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.9

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users and device configurations was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This can only be exploited once an attacker gains root privileges on the devices using an authentication bypass issue or another vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

My Cloud Home Duo Firmware · Westerndigital

95%

v < 9.4.0-191

Affected range stops below 9.4.0-191, so it looks safe — our inference, not a vendor statement

westerndigital-my-cloud-home-duo (same device)

My Cloud Home Firmware · Westerndigital

95%

v < 9.4.0-191

Affected range stops below 9.4.0-191, so it looks safe — our inference, not a vendor statement

westerndigital-my-cloud-home (same device)

My Cloud OS 5 · Westerndigital

95%

v < 5.26.202

Affected range stops below 5.26.202, so it looks safe — our inference, not a vendor statement

westerndigital-my-cloud-dl2100 (environment) · westerndigital-my-cloud-dl4100 (environment) · westerndigital-my-cloud-ex2-ultra (environment) · westerndigital-my-cloud-ex2100 (environment) · westerndigital-my-cloud-ex4100 (environment) · westerndigital-my-cloud-mirror-g2 (environment) · westerndigital-my-cloud-pr2100 (environment) · westerndigital-my-cloud-pr4100 (environment) · westerndigital-wd-cloud (environment) · westerndigital-my-cloud (same device)

Sandisk Ibi Firmware · Westerndigital

95%

v < 9.4.0-191

Affected range stops below 9.4.0-191, so it looks safe — our inference, not a vendor statement

westerndigital-sandisk-ibi (same device)

Ibi · Sandisk

60%

v < 9.4.0-191

Affected range stops below 9.4.0-191, so it looks safe — our inference, not a vendor statement

My Cloud · Westerndigitaldevice

80%

All versions