CVE-2022-27263 - An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file

CRITICAL

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file

Published Apr 12, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 3.22%

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.

Ecosystem	Package	Introduced	Fixed
npm	strapi	0	not fixed

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1693		Advisory
https://github.com/advisories/GHSA-9qgm-w87q-hx89		Advisory
https://github.com/strapi/strapi		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-27263
https://www.youtube.com/watch?v=LEeabouqRrg		x_refsource_MISCExploitThird Party Advisory