CVE-2022-27140: Unrestricted Upload of File with Dangerous Type

April 12, 2022 (updated December 15, 2023)

An arbitrary file upload vulnerability in the file upload module of Express-Fileupload v1.3.1 allows attackers to execute arbitrary code via a crafted PHP file.

References

nvd.nist.gov/vuln/detail/CVE-2022-27140
www.youtube.com/watch?v=4XpofFi84KI

Code Behaviors & Features

Detect and mitigate CVE-2022-27140 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →