GHSA-w4m6-x6c2-j5c9HighCVSS 7.5

Express-FileUpload Arbitrary File Overwrite

Published
April 13, 2022
Last Modified
October 19, 2023

🔗 CVE IDs covered (1)

CVE-2022-27261 →

📋 Description

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server. This vulnerability is debated by the package author.

🎯 Affected products1

  • npm/express-fileupload:<= 1.3.1

🔗 References (6)