Unrestricted Upload of File with Dangerous Type in ButterCMS

KRITISCH 9.8CVE-2022-27260 · GHSA-3v5x-qjrp-q2hq · Published 12/04/2022 · updated 09/07/2026

Kurz gesagt

CVE-2022-27260 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in buttercms (buttercms), buttercms.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.1%, höher als bei 88.0% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
buttercms buttercms	`= 1.2.8`	No fix yet
buttercms npm	`≤ 1.2.8`	No fix yet

Description

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

NVD description

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

References

nvd.nist.gov/vuln/detail/CVE-2022-27260 · ADVISORY
ButterCMS/buttercms-js · PACKAGE
youtube.com/watch · WEB
share.getcloudapp.com/nOuR70WB · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free