CVE-2022-27139: Malicious File Upload
DISPUTED An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploading of SVG files to Ghost does not represent a remote code execution vulnerability. SVGs are not executable on the server, and may only execute javascript in a client's browser - this is expected and intentional functionality.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-27139?
CVE-2022-27139 is considered a high severity vulnerability due to its potential for arbitrary file upload and code execution.
How do I fix CVE-2022-27139?
To mitigate CVE-2022-27139, ensure that file uploads are restricted to trusted authenticated users and consider disabling SVG uploads if not necessary.
What versions of Ghost are affected by CVE-2022-27139?
CVE-2022-27139 specifically affects Ghost version 4.39.0.
Can CVE-2022-27139 be exploited by unauthenticated users?
According to the vendor, CVE-2022-27139 can only be exploited by trusted authenticated users.
What type of file can be used in an attack for CVE-2022-27139?
An attacker can exploit CVE-2022-27139 by uploading a crafted SVG file to execute arbitrary code.