CVE-2022-27261: Unrestricted Upload of File with Dangerous Type

April 12, 2022 (updated October 18, 2023)

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server.

References

nvd.nist.gov/vuln/detail/CVE-2022-27261
www.npmjs.com/package/express-fileupload
www.youtube.com/watch?v=3ROHB3ck4tA

Code Behaviors & Features

Detect and mitigate CVE-2022-27261 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →