CVE-2022-27261: Malicious File Upload
First published: Tue Apr 12 2022(Updated: )
An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/express-fileupload | <=1.3.1 | |
| Express-fileupload | =1.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.npmjs.com/package/express-fileupload
- https://www.youtube.com/watch?v=3ROHB3ck4tA
- https://nvd.nist.gov/vuln/detail/CVE-2022-27261
- https://github.com/richardgirges/express-fileupload/issues/312
- https://github.com/richardgirges/express-fileupload/issues/316
- https://github.com/advisories/GHSA-w4m6-x6c2-j5c9 (Advisory)
Frequently Asked Questions
What is CVE-2022-27261?
CVE-2022-27261 is an arbitrary file write vulnerability in Express-FileUpload v1.3.1.
How does the vulnerability in Express-FileUpload v1.3.1 allow attackers to compromise the server?
The vulnerability allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server.
What is the severity of CVE-2022-27261?
The severity of CVE-2022-27261 is high with a CVSS score of 7.5.
How can I fix the arbitrary file write vulnerability in Express-FileUpload v1.3.1?
To fix the vulnerability, upgrade to a version of Express-FileUpload that is not affected, if available. Alternatively, consider using a different file upload library.
Where can I find more information about CVE-2022-27261?
You can find more information about CVE-2022-27261 in the references provided: https://nvd.nist.gov/vuln/detail/CVE-2022-27261
- collector/github-advisory-latest
- alias/GHSA-w4m6-x6c2-j5c9
- alias/CVE-2022-27261
- collector/github-advisory
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- collector/nvd-api
- package-manager/npm
- vendor/express-fileupload project
- canonical/express-fileupload
- version/express-fileupload/1.3.1