Unrestricted Upload of File with Dangerous Type in ButterCMS

CRÍTICO 9.8CVE-2022-27260 · GHSA-3v5x-qjrp-q2hq · Published 12/04/2022 · updated 09/07/2026

Em resumo

CVE-2022-27260 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta buttercms (buttercms), buttercms.
Chance de exploração nos próximos 30 dias (EPSS): 3.1%, maior que 88.0% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
buttercms buttercms	`= 1.2.8`	No fix yet
buttercms npm	`≤ 1.2.8`	No fix yet

Description

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

NVD description

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

References

nvd.nist.gov/vuln/detail/CVE-2022-27260 · ADVISORY
ButterCMS/buttercms-js · PACKAGE
youtube.com/watch · WEB
share.getcloudapp.com/nOuR70WB · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free