Unrestricted Upload of File with Dangerous Type in ButterCMS

CRITICO 9.8CVE-2022-27260 · GHSA-3v5x-qjrp-q2hq · Published 12/04/2022 · updated 09/07/2026

In breve

CVE-2022-27260 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda buttercms (buttercms), buttercms.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.1%, superiore al 88.0% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
buttercms buttercms	`= 1.2.8`	No fix yet
buttercms npm	`≤ 1.2.8`	No fix yet

Description

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

NVD description

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

References

nvd.nist.gov/vuln/detail/CVE-2022-27260 · ADVISORY
ButterCMS/buttercms-js · PACKAGE
youtube.com/watch · WEB
share.getcloudapp.com/nOuR70WB · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free