CVE-2022-41705 Badaso vulnerable to Remote Code Execution (RCE)
Unauthenticated attackers can execute arbitrary code on Badaso servers due to improper validation of uploaded files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-41705?
CVE-2022-41705 is a critical vulnerability in Badaso, published on 25 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
Weakness: CWE-434
Which versions are affected by CVE-2022-41705?
2 open source packages ship an affected version, including badaso/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
badaso/core Packagist | All versions | 2.7.0 |
badaso/core Packagist | All versions | 2.7.0 |
Products include Uatech Badaso.
How do I fix CVE-2022-41705?
Upgrade badaso/core to 2.7.0 or later.
Is CVE-2022-41705 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41705 exists.
Other vulnerabilities in Badaso
- CVE-2025-52353 Badaso CMS file upload vulnerability
- CVE-2022-41711 Badaso vulnerable to Remote Code Execution via malicious file upload
- CVE-2025-15398 Uasoft badaso Token BadasoAuthController.php forgetPassword password recovery
- CVE-2023-38970 Badaso vulnerable to cross-site scripting
- CVE-2023-38971 Cross-site scripting in n/a
Sources
Also known as GHSA-g389-rf5p-fg56.