CVE-2022-25299: Arbitrary File Write
This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mghttpupload() method may enable attackers to write files to arbitrary locations outside the designated target folder.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-25299?
CVE-2022-25299 is a vulnerability that affects the package cesanta/mongoose before version 7.6.
What is the severity of CVE-2022-25299?
The severity of CVE-2022-25299 is critical with a severity value of 7.5.
How does CVE-2022-25299 affect Cesanta Mongoose?
CVE-2022-25299 in Cesanta Mongoose allows unsafe handling of file names during upload, enabling attackers to write files to arbitrary locations outside the designated target folder.
How can I fix CVE-2022-25299?
To fix CVE-2022-25299, it is recommended to update the cesanta/mongoose package to version 7.6 or above.
Is there any reference for CVE-2022-25299?
Yes, you can find more information about CVE-2022-25299 at the following references: [GitHub](https://github.com/cesanta/mongoose/commit/c65c8fdaaa257e0487ab0aaae9e8f6b439335945) and [Snyk](https://snyk.io/vuln/SNYK-UNMANAGED-CESANTAMONGOOSE-2404180).