CVE-2022-50890: Owlfiles File Manager Path Traversal Flaw

CVE-2022-50890 Overview

CVE-2022-50890 is a path traversal vulnerability affecting Owlfiles File Manager version 12.0.1. The vulnerability exists in the application's built-in HTTP server, which fails to properly sanitize user-supplied input in GET requests. By crafting malicious requests containing directory traversal sequences (such as ../), attackers can escape the intended web root directory and access restricted system directories on the target device.

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a common weakness that allows attackers to access files and directories outside of the intended scope of the application.

Critical Impact

Attackers can read sensitive system files and directories on devices running the vulnerable Owlfiles File Manager HTTP server, potentially exposing credentials, configuration data, and other confidential information.

Affected Products

• Owlfiles File Manager 12.0.1
• Skyjos Owlfiles (iOS Application)
• Devices running the built-in HTTP server feature

Discovery Timeline

• 2026-01-13 - CVE CVE-2022-50890 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2022-50890

Vulnerability Analysis

The path traversal vulnerability in Owlfiles File Manager 12.0.1 stems from insufficient input validation in the application's built-in HTTP server component. When the HTTP server feature is enabled, the application accepts GET requests from network clients but fails to adequately filter or sanitize directory traversal sequences embedded within the requested file paths.

This weakness allows unauthenticated attackers on the network to craft malicious HTTP requests that include path traversal characters (../) to navigate outside the designated web root directory. Once outside the intended directory structure, attackers can read arbitrary files from the underlying file system, limited only by the permissions of the process running the HTTP server.

The vulnerability is network-accessible, meaning any attacker with network connectivity to the device running the vulnerable HTTP server can attempt exploitation without requiring authentication or user interaction.

Root Cause

The root cause of this vulnerability is improper input validation in the HTTP request handling logic. The application's HTTP server fails to implement adequate path canonicalization and validation before processing file requests. Specifically:

1. The server accepts user-controlled file path parameters in GET requests
2. Directory traversal sequences (../, ..%2f, etc.) are not properly filtered or rejected
3. No path canonicalization is performed to resolve the final absolute path before serving files
4. The resolved path is not validated against the intended web root directory boundary

This allows attackers to construct request URIs that, when processed by the server, resolve to file system locations outside the intended serving directory.

Attack Vector

The attack vector is network-based, requiring the attacker to have network access to the device running the Owlfiles File Manager HTTP server. The attack can be executed through the following general approach:

1. Identify a target device with Owlfiles File Manager's HTTP server feature enabled
2. Craft HTTP GET requests containing directory traversal sequences in the URL path
3. Send the malicious requests to the target server
4. The server processes the request, resolving the path to a location outside the web root
5. Sensitive file contents are returned in the HTTP response

The vulnerability can be exploited remotely without authentication, making it particularly dangerous when the HTTP server is exposed to untrusted networks. For detailed technical information and exploitation techniques, refer to the Exploit-DB #51036 entry and the VulnCheck Advisory for OwlFiles.

Detection Methods for CVE-2022-50890

Indicators of Compromise

• HTTP server logs showing requests with ../ sequences or URL-encoded variants (%2e%2e%2f)
• Unusual access patterns to the Owlfiles HTTP server from external or unexpected IP addresses
• Web server logs indicating requests for system files such as /etc/passwd, configuration files, or other sensitive paths
• Network traffic containing HTTP requests with abnormally long URL paths containing repeated traversal patterns

Detection Strategies

• Implement network intrusion detection rules to identify HTTP requests containing path traversal sequences targeting Owlfiles servers
• Monitor HTTP access logs for requests containing .., %2e, or other encoded traversal characters
• Deploy web application firewall (WAF) rules to block requests with directory traversal patterns
• Use endpoint detection solutions to monitor for suspicious file access attempts by the Owlfiles application process

Monitoring Recommendations

• Enable verbose logging on devices running Owlfiles File Manager's HTTP server feature
• Implement network segmentation to limit exposure of devices with the HTTP server feature enabled
• Configure alerts for anomalous network traffic patterns targeting mobile device HTTP services
• Regularly review access logs for evidence of exploitation attempts or reconnaissance activity

How to Mitigate CVE-2022-50890

Immediate Actions Required

• Disable the built-in HTTP server feature in Owlfiles File Manager if not actively required
• Restrict network access to devices running the vulnerable HTTP server using firewall rules
• Avoid exposing Owlfiles HTTP server to untrusted networks or the internet
• Update Owlfiles File Manager to the latest available version from the Apple App Store
• Monitor for vendor security advisories from Skyjos regarding patches for this vulnerability

Patch Information

Organizations should check with the vendor Skyjos for updated versions of Owlfiles File Manager that address this path traversal vulnerability. Monitor the Apple App Store listing for application updates and review release notes for security fixes. The VulnCheck Advisory may contain additional remediation guidance.

Workarounds

• Disable the HTTP server feature entirely within Owlfiles File Manager application settings
• Implement network-level access controls to limit connectivity to the HTTP server port to trusted hosts only
• Use a VPN or other secure channel when file sharing is required, rather than the built-in HTTP server
• Deploy network monitoring to detect and block exploitation attempts at the perimeter

# Network firewall rule example - block external access to common HTTP ports used by file manager apps
# Adjust ports as needed based on your Owlfiles HTTP server configuration
iptables -A INPUT -p tcp --dport 8080 -j DROP
iptables -A INPUT -p tcp --dport 80 -j DROP