CVE-2022-25297: Arbitrary File Write
This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations outside the designated target folder.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25297?
CVE-2022-25297 is considered a high severity vulnerability due to the potential for arbitrary file writing.
How do I fix CVE-2022-25297?
To fix CVE-2022-25297, upgrade to Drogon version 1.7.5 or later where this vulnerability has been addressed.
What types of attacks can CVE-2022-25297 enable?
CVE-2022-25297 can enable attackers to write files to arbitrary locations on the server, leading to potential unauthorized access or data leaks.
Which versions of Drogon are affected by CVE-2022-25297?
CVE-2022-25297 affects all versions of Drogon before 1.7.5.
What is the context of CVE-2022-25297?
CVE-2022-25297 relates to unsafe file handling during uploads using the HttpFile::save() method in the Drogon framework.