CVE-2022-27140: express-fileupload_project express-fileupload

Vulnerability summary

CVE-2022-27140 is a critical (CVSS 9.8) vulnerability in express-fileupload_project express-fileupload. EPSS estimates a 2.86% chance of exploitation in the next 30 days, higher than 86.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-04-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the observed behavior can only occur with "intentional misusing of the API": the express-fileupload middleware is not responsible for an application's business logic (e.g., determining whether or how a file should be renamed).

• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.