Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS13NG02LXg2YzItajVjOc07AQ

Express-FileUpload Arbitrary File Overwrite

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server. This vulnerability is debated by the package author.

Permalink: https://github.com/advisories/GHSA-w4m6-x6c2-j5c9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13NG02LXg2YzItajVjOc07AQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Percentage: 0.001
EPSS Percentile: 0.42643

Identifiers: GHSA-w4m6-x6c2-j5c9, CVE-2022-27261
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-27261
• https://www.npmjs.com/package/express-fileupload
• https://www.youtube.com/watch?v=3ROHB3ck4tA
• https://github.com/richardgirges/express-fileupload/issues/312
• https://github.com/richardgirges/express-fileupload/issues/316
• https://github.com/advisories/GHSA-w4m6-x6c2-j5c9

Repository: https://github.com/richardgirges/express-fileupload
Blast Radius: 33.2

Affected Packages