{"answers":{"affected":"6 open source packages ship an affected version, including drupal/core and drupal. It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-25277 in the wild and no public exploit code.","fix":"Upgrade drupal/core to a fixed version for your release line: 9.3.19 or 9.4.3.","what":"CVE-2022-25277 is a high-severity vulnerability in Drupal Drupal, published on 26 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-25277 and fix it if it is affected.\n\nWhat it is: CVE-2022-25277 is a high-severity vulnerability in Drupal Drupal, published on 26 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-25277 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- drupal/core (Packagist): affected from 8.0.0; fixed in 9.3.19, 9.4.3\n- drupal/core (Packagist): affected from 8.0.0; fixed in 9.3.19\n- drupal/core (Packagist): affected from 8.0.0; fixed in 9.3.19\n- drupal/core (Packagist): affected from 9.4.0; fixed in 9.4.3\n- drupal/core (Packagist): affected from 9.4.0; fixed in 9.4.3\n- drupal (Bitnami): affected from 8.0.0; fixed in 9.3.19, 9.4.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-25277/ (Markdown: https://insights.sbomify.com/CVE-2022-25277/index.md)","id":"CVE-2022-25277","markdown":"https://insights.sbomify.com/CVE-2022-25277/index.md","name":"CVE-2022-25277","record":{"aliases":["BIT-drupal-2022-25277","DRUPAL-CORE-2022-014","GHSA-6955-67hm-vjjq","UBUNTU-CVE-2022-25277"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["code_execution","security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Drupal core","requires_auth":"high_privilege","summary":"Attackers can upload malicious .htaccess files to bypass protections and achieve remote code execution if file fields are explicitly configured to allow this extension.","user_interaction":"not_required","vuln_class":"file_upload"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"drupal","cpe":[{"product":"drupal","vendor":"drupal"}],"cvss":{"score":7.2,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"description":"Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.","ecosystems":["Bitnami","Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Drupal core arbitrary PHP code execution","id":"CVE-2022-25277","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":"drupal:drupal","products":["drupal:drupal"],"type":"file_upload","year":"2022"},"n_packages":6,"n_references":1,"next":{"headline":"Access bypass in Drupal Core","id":"CVE-2022-25278"},"packages":[{"ecosystem":"Bitnami","fixed":["9.3.19","9.4.3"],"introduced":["8.0.0","9.4.0"],"last_affected":[],"package":"drupal","purl":"pkg:bitnami/drupal","source":"BIT-drupal-2022-25277"},{"ecosystem":"Packagist","fixed":["9.3.19","9.4.3"],"introduced":["8.0.0","9.4.0"],"last_affected":[],"package":"drupal/core","purl":"pkg:composer/drupal/core","source":"DRUPAL-CORE-2022-014"},{"ecosystem":"Packagist","fixed":["9.3.19"],"introduced":["8.0.0"],"last_affected":[],"package":"drupal/core","purl":null,"source":"GHSA-6955-67hm-vjjq"},{"ecosystem":"Packagist","fixed":["9.3.19"],"introduced":["8.0.0"],"last_affected":[],"package":"drupal/core","purl":"pkg:composer/drupal/core","source":"GHSA-6955-67hm-vjjq"},{"ecosystem":"Packagist","fixed":["9.4.3"],"introduced":["9.4.0"],"last_affected":[],"package":"drupal/core","purl":null,"source":"GHSA-6955-67hm-vjjq"},{"ecosystem":"Packagist","fixed":["9.4.3"],"introduced":["9.4.0"],"last_affected":[],"package":"drupal/core","purl":"pkg:composer/drupal/core","source":"GHSA-6955-67hm-vjjq"}],"prev":{"headline":"Lack of domain validation in Druple core","id":"CVE-2022-25276"},"products":["Core"],"published":"2023-04-26","related":[{"cvss_score":9.8,"headline":"Drupal Core SQL Injection","id":"CVE-2026-9082","kev_date_added":"2026-05-22","published":"2026-05-20"},{"cvss_score":8.8,"headline":"Drupal core Un-restricted Upload of File","id":"CVE-2020-13671","kev_date_added":"2022-01-18","published":"2020-11-20"},{"cvss_score":8.1,"headline":"Drupal Core Remote Code Execution","id":"CVE-2019-6340","kev_date_added":"2022-03-25","published":"2019-02-21"},{"cvss_score":10,"headline":"Other in n/a","id":"CVE-2009-3352","kev_date_added":null,"published":"2009-09-24"},{"cvss_score":9.8,"headline":"Drupal core - Less critical - Gadget chain - SA-CORE-2024-006","id":"CVE-2024-55636","kev_date_added":null,"published":"2024-12-09"},{"cvss_score":9.8,"headline":"Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007","id":"CVE-2024-55637","kev_date_added":null,"published":"2024-12-09"},{"cvss_score":9.8,"headline":"Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008","id":"CVE-2024-55638","kev_date_added":null,"published":"2024-12-09"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"MIT","name":"Drupal","prefix":"DRUPAL"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-02-03","vendors":["Drupal"]},"summary":"Attackers can upload malicious .htaccess files to bypass protections and achieve remote code execution if file fields are explicitly configured to allow this extension.","url":"https://insights.sbomify.com/CVE-2022-25277/"}