UniPay Security Advisory: CVE-2022-36537

Advisory Information

Advisory ID: UT-UPG-SA-2026-001
CVE: CVE-2022-36537
Product: UniPay Gateway
Component: ZK Framework file upload handler used by the legacy UniPay UI
Published: August 17, 2026
Last updated: August 17, 2026

Summary

Potix/ZK developed the remediation for CVE-2022-36537 as part of ZK-5150. Because the standard ZK 5.0.13 release does not include this corrective change, United Thinkers requested and received an official vendor-supplied backport under ZK Support Ticket #16278. United Thinkers integrated the backport into UniPay in 2024.

The remediation does not replace zk-5.0.13.jar and does not change the ZK version number. Therefore, security scanners that rely only on the detected or self-reported ZK version may continue to report CVE-2022-36537 after the remediation has been correctly deployed.

Official UniPay V10.1.0.4 and later deployments can be considered protected from this vulnerability after the patch classes, their runtime registration, and the active deployment have been verified using the procedure below.

Affected and Remediated Versions

Affected versions

UniPay Gateway releases that use the original unpatched ZK upload handler are affected unless a separate customer-specific hotfix was provided.

Remediated versions

United Thinkers integrated the remediation into the general UniPay product line starting with release V9.2.3. Official UniPay V10.1.0.4 and later release packages contain this remediation.

Patch Implementation

Starting with the official UniPay V10.1.0.4 release package, UniPay replaces the original ZK upload handler with:

org.zkoss.zk.au.http.AuUploaderPatch508

The same package also includes the associated file item factory:

org.zkoss.zk.au.http.ZkFileItemFactory

The patched handler does not use the request-controlled nextURI parameter. Upload completion is always forwarded through Servlets.forward to the following fixed internal resource:

~./zul/html/fileupload-done.html.dsp

The handler is registered through the following web.xml configuration:

<servlet>
    <description>The asynchronous update engine for ZK</description>
    <servlet-name>auEngine</servlet-name>
    <servlet-class>org.zkoss.zk.au.http.DHtmlUpdateServlet</servlet-class>

    <init-param>
        <param-name>extension0</param-name>
        <param-value>/upload=org.zkoss.zk.au.http.AuUploaderPatch508</param-value>
    </init-param>
</servlet>

The patched classes are packaged in 103-imerchant-ui.war. Atlas and iBilling register the same handler in their own WEB-INF/web.xml files and load its implementation from 103-imerchant-ui.war through the JBoss subdeployment dependencies declared in META-INF/jboss-deployment-structure.xml.

Verification

The artifact paths and verification procedure below apply to official UniPay V10.1.0.4 and later release packages delivered to Optum. The listed file sizes and SHA-256 values are reference values for the official UniPay V10.1.0.4 release package.

1. Verify the classes in the EAR/WAR

Stable paths inside the release artifact:

unipay.ear!/103-imerchant-ui.war!/WEB-INF/classes/org/zkoss/zk/au/http/AuUploaderPatch508.class

unipay.ear!/103-imerchant-ui.war!/WEB-INF/classes/org/zkoss/zk/au/http/ZkFileItemFactory.class

Example commands:

EAR=/absolute/path/to/unipay.ear
VERIFY_DIR=$(mktemp -d)

unzip -q "$EAR" \
  103-imerchant-ui.war \
  204-atlas-ui.war \
  304-ibilling-ui.war \
  META-INF/jboss-deployment-structure.xml \
  -d "$VERIFY_DIR"

mkdir -p "$VERIFY_DIR/103" "$VERIFY_DIR/204" "$VERIFY_DIR/304"
unzip -q "$VERIFY_DIR/103-imerchant-ui.war" -d "$VERIFY_DIR/103"
unzip -q "$VERIFY_DIR/204-atlas-ui.war" -d "$VERIFY_DIR/204"
unzip -q "$VERIFY_DIR/304-ibilling-ui.war" -d "$VERIFY_DIR/304"

test -f "$VERIFY_DIR/103/WEB-INF/classes/org/zkoss/zk/au/http/AuUploaderPatch508.class"
test -f "$VERIFY_DIR/103/WEB-INF/classes/org/zkoss/zk/au/http/ZkFileItemFactory.class"

2. Verify handler registration

Check these files:

unipay.ear!/103-imerchant-ui.war!/WEB-INF/web.xml
unipay.ear!/204-atlas-ui.war!/WEB-INF/web.xml
unipay.ear!/304-ibilling-ui.war!/WEB-INF/web.xml

Command:

for WEB_ROOT in "$VERIFY_DIR/103" "$VERIFY_DIR/204" "$VERIFY_DIR/304"; do
  grep -A1 -B1 -F '<param-name>extension0</param-name>' "$WEB_ROOT/WEB-INF/web.xml"
  grep -F '<param-value>/upload=org.zkoss.zk.au.http.AuUploaderPatch508</param-value>' "$WEB_ROOT/WEB-INF/web.xml"
done

Each file must contain:

<param-name>extension0</param-name>
<param-value>/upload=org.zkoss.zk.au.http.AuUploaderPatch508</param-value>

3. Verify patch-class SHA-256 values

Command:

sha256sum \
  "$VERIFY_DIR/103/WEB-INF/classes/org/zkoss/zk/au/http/AuUploaderPatch508.class" \
  "$VERIFY_DIR/103/WEB-INF/classes/org/zkoss/zk/au/http/ZkFileItemFactory.class"

Expected values for the official UniPay V10.1.0.4 release package:

Artifact: AuUploaderPatch508.class
Size: 14,384 bytes
SHA-256: 99d9e7056c7c26e1c484a2932e0cc44c7ac8808f23f0ca3772d0016af544c8e1

Artifact: ZkFileItemFactory.class
Size: 3,048 bytes
SHA-256: 2d9832e8ea67987707bb11514e7f30bf759e43c48934d21f5f8b1111a1aa7035

These reference values apply to the official UniPay V10.1.0.4 package. The same artifact locations and verification procedure apply to later packages; their SHA-256 values may differ if the classes are rebuilt.

4. Verify security-relevant bytecode

Command:

javap \
  -classpath "$VERIFY_DIR/103/WEB-INF/classes:$VERIFY_DIR/103/WEB-INF/lib/*" \
  -c -p org.zkoss.zk.au.http.AuUploaderPatch508 \
  | grep -E 'fileupload-done|nextURI|Servlets.forward'

The output must contain:

String ~./zul/html/fileupload-done.html.dsp
org/zkoss/web/servlet/Servlets.forward

The output must not contain nextURI.

5. Verify JBoss subdeployment dependencies

Check:

unipay.ear!/META-INF/jboss-deployment-structure.xml

Command:

for SUBDEPLOYMENT in 204-atlas-ui.war 304-ibilling-ui.war; do
  sed -n "/<sub-deployment name=\"$SUBDEPLOYMENT\">/,/<\/sub-deployment>/p" \
    "$VERIFY_DIR/META-INF/jboss-deployment-structure.xml" \
    | grep -F 'module name="deployment.unipay.ear.103-imerchant-ui.war"'
done

Both subdeployments must depend on 103-imerchant-ui.war.

6. Successful verification criteria

An official UniPay V10.1.0.4 or later deployment is considered remediated only when all of the following conditions are met:

Both patch classes are present in 103-imerchant-ui.war.
For V10.1.0.4, the SHA-256 values match the published reference values. For a later release, the verified classes must belong to the official United Thinkers release package being assessed.
The bytecode contains the fixed destination and does not contain nextURI.
In all three web.xml files, /upload is registered to AuUploaderPatch508.
Atlas and iBilling have a JBoss dependency on 103-imerchant-ui.war.
The verified files belong to the active unipay.ear, not to an old VFS directory or another release package.

References

CVE-2022-36537
ZK upstream security fix
UniPay Integrated 3rd Party Libraries
United Thinkers Support — through the customer's established support channel.