CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi
Attackers can execute arbitrary code by uploading a crafted file to the Strapi CMS file upload module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27263?
CVE-2022-27263 is a critical vulnerability in n/a, published on 12 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.
Weakness: CWE-434
Which versions are affected by CVE-2022-27263?
2 open source packages ship an affected version, including strapi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
strapi npm | All versions to 4.1.5 | None |
strapi npm | All versions to 4.1.5 | None |
Products include Strapi Strapi.
How do I fix CVE-2022-27263?
No fix has been published for CVE-2022-27263 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-27263 being exploited?
There is no known exploitation of CVE-2022-27263 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information
- CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
- CVE-2020-27664 Authorization bypass in Strapi
- CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token
- CVE-2026-22599 Strapi Vulnerable to SQL Injection in Content Type Builder
Sources
Also known as GHSA-9qgm-w87q-hx89.