Security Advisory
CVE-2022-25299
9.8
CRITICAL
Vulnerability Description
This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder.
Published Date
February 18, 2022
Official Source
NIST NVD Advisory