gcdRadar
archive/Patch now/AIR-2022-0101
closedclosed 10 Jan 2022Patch now2 Disclosed vulnerabilityAI

CVE-2022-22821: NVIDIA NeMo ASR WebApp Path Traversal

NVIDIA NeMo

A path traversal vulnerability in NVIDIA NeMo ASR WebApp allows file deletion when administrative privileges are available. A vendor patch was released.

disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why

CVSS
4.4
EPSS
<0.01 · top 76% · 2026-11-13
EPSS scores by FIRST
fix status
Fix status unknown
first report
10 Jan 2022
last update
10 Jan 2022
CVE ids
CVE-2022-22821other records

Timeline · 1

  1. 10 Jan 2022CVE-2022-22821: NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any…

Sources · 1

Advisories and databases

  1. 2022-01-10
    CVE-2022-22821: NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any…
    NVD · nvd.nist.gov/vuln/detail/CVE-2022-22821

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Patch now
AI role
Attack on AI
categories
Infrastructure vulnerability
severity
2 · Disclosed vulnerability
fix status
Fix status unknown
targets
Framework / tooling
owasp llm top 10
LLM03:2025 Supply Chain
mitre atlas
no technique for these categories
tags
path-traversalnvidia-nemo
dates
happened 10 Jan 2022 · first reported 10 Jan 2022
origin
NVD
Vulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
record
confidence 0.95 · created 2026-10-18 10:04Z · updated 2026-10-18 10:04Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# CVE-2022-22821: NVIDIA NeMo ASR WebApp Path Traversal

https://gcdradar.vercel.app/incidents/cve-2022-22821-nvidia-nemo-asr-webapp-path-traversal · AIR-2022-0101 · closed 2022-01-10

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2022-01-10
- AI role: Attack on AI
- Products: NVIDIA NeMo
- CVE ids: CVE-2022-22821
- CVSS: 4.4

## Summary

A path traversal vulnerability in NVIDIA NeMo ASR WebApp allows file deletion when administrative privileges are available. A vendor patch was released.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2022-01-10: CVE-2022-22821: NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any… (https://nvd.nist.gov/vuln/detail/CVE-2022-22821)

## Sources

- 2022-01-10 NVD: CVE-2022-22821: NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any… https://nvd.nist.gov/vuln/detail/CVE-2022-22821

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed9.3
    Gradio CVE-2021-43831: Local file access vulnerability in Gradio interface

    Patch now · Disclosed · since 21 Jan 2022 · updated 21 Jan 2022 · CVE-2021-43831

    AI
  2. closed8.6
    Gradio CVE-2023-51449: File traversal and SSRF vulnerability in Gradio

    Patch now · Disclosed · since 21 Dec 2023 · updated 22 Dec 2023 · CVE-2023-51449

    AI
  3. closed7.8
    Hugging Face libraries CVE-2023-7018: Deserialization vulnerability in Hugging Face transformers

    Patch now · Disclosed · since 20 Dec 2023 · CVE-2023-7018

    AI
  4. closed9.0
    Hugging Face libraries CVE-2023-6730: Deserialization vulnerability in Hugging Face transformers

    Patch now · Disclosed · since 19 Dec 2023 · CVE-2023-6730

    AI
  5. closed9.6
    Gradio CVE-2023-6572: Information exposure vulnerability in Gradio

    Patch now · Disclosed · since 14 Dec 2023 · CVE-2023-6572

    AI
  6. closed9.8
    Ray ShadowRay Active Exploitation of Exposed Ray Clusters

    Patch now · Exploited · since 5 Sep 2023 · updated 14 Mar 2025 · CVE-2023-48022

    AI