CVE-2022-40797 File upload in n/a

Critical 9.8 Published 9 Nov 2022 Updated 1 May 2025

Attackers can achieve remote code execution by uploading .phar files due to incomplete default upload restrictions in Roxy Fileman.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-40797?

CVE-2022-40797 is a critical vulnerability in n/a, published on 9 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations.)

Weakness: CWE-434

Which versions are affected by CVE-2022-40797?

It affects 1 product.

Products include Roxyfileman Roxy Fileman.

How do I fix CVE-2022-40797?

No fix has been published for CVE-2022-40797 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-40797 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-40797 exists.

Sources

Also known as GHSA-jpq9-fcx6-h2p8.