Vulnerabilities

TI-2022-10376 CVE-2022-27261 · GHSA-w4m6-x6c2-j5c9

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to…

LOW 36

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01381 Published 2022-04-12 No fix listed CWE-434

TI-2022-10278 CVE-2022-27140 · GHSA-4fvq-q2rx-hw88

An arbitrary file upload vulnerability in the file upload module of express-fileupload…

MEDIUM 47

An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02861 Published 2022-04-12 No fix listed CWE-434

TI-2020-06219 CVE-2020-7699 · GHSA-9wcg-jrwf-8gg7

Prototype pollution in express-fileupload

MEDIUM 50

This affects the package express-fileupload before 1.1.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04762 Published 2020-07-30 Fixed in 1.1.8, 1.1.9 CWE-1321

Vulnerabilities

Filters

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to…

An arbitrary file upload vulnerability in the file upload module of express-fileupload…

Prototype pollution in express-fileupload