VULNERABILITY INTELLIGENCE

CVE-2022-2102

CVSS score9.4 CRITICAL

EPSS probability0.95%

CISA KEVNot currently listed

Published2022-06-24

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Description

Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed.

Weakness classification

CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-841: Improper Enforcement of Behavioral Workflow

Primary references

ics-cert@hq.dhs.gov — Mitigation, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Third Party Advisory, US Government Resource