Aller au contenu
Se connecter
7.5 Élevée

CVE-2022-25297 This affects the package drogonframework/drogon before 1.7.5

Description

This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations outside the designated target folder.

Produits et versions touchés

Produit Versions touchées Corrigé en
drogonframework/drogon 1.7 premières → < 1.7.5 1.7.5

Autres CVE de drogonframework/drogon

Les 3 CVE de drogonframework/drogon →
CVE-2023-26137 All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input… 7.2 Élevée CVE-2023-26138 All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to… 5.4 Moyenne
Suivre cette CVE