CVE-2022-23626 Insufficient file checks in m1k1o/blog

High 8.5 Published 8 Feb 2022 Updated 22 Apr 2025

Attackers can upload malicious files that bypass image validation checks, potentially leading to remote code execution on the server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-23626?

CVE-2022-23626 is a high-severity vulnerability in m1k1o blog, published on 8 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Weakness: CWE-252, CWE-20

Which versions are affected by CVE-2022-23626?

It affects 1 product.

Products include Blog Project Blog.

How do I fix CVE-2022-23626?

No fix has been published for CVE-2022-23626 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-23626 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23626 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-wmqj-5v54-24x4.