CVE-2022-27061

HIGH

AeroCMS 0.0.1 - Authenticated Arbitrary File Upload via Post Image Function

Title source: llm
STIX 2.1

Description

AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

References (3)

Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/D4rkP0w4r/AeroCMS-Unrestricted-File-Upload-POC
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/166659/AeroCMS-0.0.1-Shell-Upload.html

Scores

CVSS v3 7.2
EPSS 0.0250
EPSS Percentile 82.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
aerocms_project/aerocms 0.0.1
Published Apr 08, 2022
Tracked Since Feb 18, 2026