Skip to content
Sign in
7.5 High

CVE-2022-25297 This affects the package drogonframework/drogon before 1.7.5

Description

This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations outside the designated target folder.

Affected products and versions

Product Affected versions Fixed in
drogonframework/drogon 1.7 earliest → < 1.7.5 1.7.5

Other CVEs of drogonframework/drogon

The 3 CVEs of drogonframework/drogon →
CVE-2023-26137 All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input… 7.2 High CVE-2023-26138 All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to… 5.4 Medium
Track this CVE