CVE-2022-1939 Allow SVG Files < 1.1 - Admin+ Arbitrary File Upload

Q: What is CVE-2022-1939?

CVE-2022-1939 is a high-severity vulnerability in Unknown Allow svg files, published on 20 Jun 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Q: Is CVE-2022-1939 being exploited?

There is no known exploitation of CVE-2022-1939 in the wild and no public exploit code.

Q: How do I fix CVE-2022-1939?

No fix has been published for CVE-2022-1939 yet. Limit exposure of the affected software until one is available.

High 7.2 Published 20 Jun 2022 Updated 3 Aug 2024

Administrators can upload PHP files via the Allow SVG Files plugin due to improper validation, leading to arbitrary code execution.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-1939?

CVE-2022-1939 is a high-severity vulnerability in Unknown Allow svg files, published on 20 Jun 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to

Weakness: CWE-434

Which versions are affected by CVE-2022-1939?

It affects 1 product.

Products include Allow Svg Files Project Allow Svg Files.

How do I fix CVE-2022-1939?

No fix has been published for CVE-2022-1939 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-1939 being exploited?

There is no known exploitation of CVE-2022-1939 in the wild and no public exploit code.

CVE-2022-2299 Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVG Medium 5.4

Sources

Also known as GHSA-8phc-fvf5-9cqv.