Unrestricted Upload of File with Dangerous Type in ButterCMS

严重 9.8CVE-2022-27260 · GHSA-3v5x-qjrp-q2hq · Published 12/04/2022 · updated 09/07/2026

要点

CVE-2022-27260 是影响 buttercms (buttercms), buttercms 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：3.1%，高于 88.0% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
buttercms buttercms	`= 1.2.8`	No fix yet
buttercms npm	`≤ 1.2.8`	No fix yet

Description

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

NVD description

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

References

nvd.nist.gov/vuln/detail/CVE-2022-27260 · ADVISORY
ButterCMS/buttercms-js · PACKAGE
youtube.com/watch · WEB
share.getcloudapp.com/nOuR70WB · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free