Is CVE-2022-27952 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-27952 being exploited in the wild.

How severe is CVE-2022-27952?

Low severity, with a CVSS score of 3.1, published 13 April 2022.

Which products and versions are affected?

payload (npm) SEMVER:introduced=0,fixed=0.15.1; Payload CMS 0.15.0 and earlier.

Is there a fix for CVE-2022-27952?

Yes. payload (npm): upgrade to 0.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-27952 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-27952?

Check whether you run payload (npm) or Payload CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-27952: Payload CMS arbitrary file upload in file module

CVE-2022-27952 · Severity: low · CVSS 3.1 · Published 2022-04-13

Payload CMS is an open-source backend framework and headless CMS platform used to build web applications and content management systems. A vulnerability in versions up to 0.15.0 allows attackers to upload malicious files (such as SVG files) without proper validation, enabling arbitrary code execution on the server and complete system compromise.

Technologies: payload (npm), Payload CMS. Vendors: npm, Payload.

Quick answers

Is CVE-2022-27952 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-27952 being exploited in the wild.
How severe is CVE-2022-27952?: Low severity, with a CVSS score of 3.1, published 13 April 2022.
Which products and versions are affected?: payload (npm) SEMVER:introduced=0,fixed=0.15.1; Payload CMS 0.15.0 and earlier.
Is there a fix for CVE-2022-27952?: Yes. payload (npm): upgrade to 0.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-27952 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-27952?: Check whether you run payload (npm) or Payload CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

payload (npm): upgrade to 0.15.1 or later
```
npm install payload@0.15.1
```

Technical details

The file upload module in Payload CMS v0.15.0 and earlier fails to properly validate uploaded files, allowing attackers to upload dangerous file types such as SVG files containing embedded code. This is a CWE-434 unrestricted file upload vulnerability. The attack requires no authentication or user interaction and is exploitable remotely over the network. An unauthenticated attacker can upload a crafted SVG file to execute arbitrary code with server privileges. The vulnerability is fixed in version 0.15.1 and later.

Affected products

Payload Payload CMS 0.15.0 and earlier

Identifiers

CVE-2022-27952
GHSA-w8xh-93qh-35vw

Timeline

2022-04-13: disclosed
2022-04-13: patched: Fix released in version 0.15.1

References

https://github.com/payloadcms/payload

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.