GitHub Advisoryadvisory · npm

GHSA-w4m6-x6c2-j5c9 Express-FileUpload Arbitrary File Overwrite

HIGH Published 2022-04-13 Modified 2023-10-19 Official page ↗
Aliases
CVE-2022-27261
Ecosystem
npm
Packages
express-fileupload
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-434
Reviewed
2023-10-19

Affected packages

• npm express-fileupload: <= 1.3.1 (no fix yet)

Description

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server. This vulnerability is debated by the package author.

Related

Alias · CVE (1)

  • CVE-2022-27261 An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References