# CVE-2022-27261: Express-FileUpload arbitrary file overwrite

Source: https://junglewise.ai/threats/cve-2022-27261-express-fileupload-arbitrary-file-overwrite  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-04-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-27261 · Severity: low · CVSS 3.1 · Published 2022-04-13

Express-FileUpload is a widely-used Node.js library that handles file uploads in web applications. A vulnerability allows attackers to upload multiple files with identical names, overwriting legitimate files on the server. This could lead to replacement of critical application files, configuration files, or user data, disrupting service availability or enabling further attacks.

Technologies: [express-fileupload (npm)](https://junglewise.ai/threats/technologies/express-fileupload). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-27261 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-27261 being exploited in the wild.

**How severe is CVE-2022-27261?** Low severity, with a CVSS score of 3.1, published 13 April 2022.

**Which products and versions are affected?** express-fileupload (npm) SEMVER:introduced=0,last_affected=1.3.1.

**Is there a fix for CVE-2022-27261?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2022-27261 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-27261?** Check whether you run express-fileupload (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CWE-434 (Unrestricted Upload of File with Dangerous Type) arbitrary file write flaw in Express-FileUpload v1.3.1 and earlier versions. When multiple files are uploaded with the same name, the library fails to prevent overwriting existing files without proper validation. The attack requires network access and no authentication; an attacker can craft HTTP requests with multiple file uploads to replace files on the server. This can result in service disruption, data loss, or execution of malicious code if the overwritten files are executable. A patch has been released in later versions of the package.

## Affected products

- Express-FileUpload express-fileupload through 1.3.1

## Identifiers

- CVE-2022-27261
- GHSA-w4m6-x6c2-j5c9

## Timeline

- 2022-04-13: disclosed
- 2022-04-12: other: NVD published

## References

- [https://github.com/richardgirges/express-fileupload/issues/312](https://github.com/richardgirges/express-fileupload/issues/312)

## Related threats

- [express-fileupload denial of service in filename processing](https://junglewise.ai/threats/express-fileupload-denial-of-service-in-filename-processing-efdc3134)
- [express-fileupload prototype pollution in nested parsing](https://junglewise.ai/threats/cve-2020-7699-express-fileupload-prototype-pollution-in-nested-parsing)