What is GHSA-w2xw-44r3-4v9g?

GHSA-w2xw-44r3-4v9g is a security advisory published by GitHub Security Advisories with High severity. Connect-Multiparty allows arbitrary file upload

Which CVE IDs does GHSA-w2xw-44r3-4v9g cover?

GHSA-w2xw-44r3-4v9g covers the following CVE IDs: CVE-2022-29623. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w2xw-44r3-4v9g?

GHSA-w2xw-44r3-4v9g has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

Which products are affected by GHSA-w2xw-44r3-4v9g?

GHSA-w2xw-44r3-4v9g affects 1 product, including: npm/connect-multiparty:\u003c= 2.2.0.

GHSA-w2xw-44r3-4v9gHighCVSS 7.8

Connect-Multiparty allows arbitrary file upload

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

May 20, 2025

🔗 CVE IDs covered (1)

CVE-2022-29623 →

📋 Description

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary code via a crafted PDF file. NOTE: the Supplier has not verified this vulnerability report.

🎯 Affected products1

npm/connect-multiparty:<= 2.2.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-29623
https://www.youtube.com/watch?v=i3xJR-91rrM
https://github.com/expressjs/connect-multiparty/releases/tag/2.2.0
https://www.npmjs.com/package/connect-multiparty
https://github.com/advisories/GHSA-w2xw-44r3-4v9g