Is CVE-2022-29623 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-29623 being exploited in the wild.

How severe is CVE-2022-29623?

Low severity, with a CVSS score of 3.1, published 17 May 2022.

Which products and versions are affected?

connect-multiparty (npm) SEMVER:introduced=0,last_affected=2.2.0.

Is there a fix for CVE-2022-29623?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2022-29623 attacked?

It is attacked with local access.

Am I affected by CVE-2022-29623?

Check whether you run connect-multiparty (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-29623: Connect-Multiparty arbitrary file upload

CVE-2022-29623 · Severity: low · CVSS 3.1 · Published 2022-05-17

Connect-Multiparty is an Express.js middleware that handles file uploads in web applications. An arbitrary file upload vulnerability allows attackers to upload malicious files (such as crafted PDFs) that can lead to code execution on the server, potentially compromising the entire application and sensitive data stored on it.

Vendors: npm.

Quick answers

Is CVE-2022-29623 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-29623 being exploited in the wild.
How severe is CVE-2022-29623?: Low severity, with a CVSS score of 3.1, published 17 May 2022.
Which products and versions are affected?: connect-multiparty (npm) SEMVER:introduced=0,last_affected=2.2.0.
Is there a fix for CVE-2022-29623?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-29623 attacked?: It is attacked with local access.
Am I affected by CVE-2022-29623?: Check whether you run connect-multiparty (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an arbitrary file upload vulnerability (CWE-434) in the file upload module of Connect-Multiparty 2.2.0 and earlier versions. The vulnerability allows attackers to bypass file validation controls and upload crafted files, such as PDFs with embedded payloads, which can result in arbitrary code execution on the affected server. The attack vector is local with user interaction required (an authenticated or unauthenticated user must trigger the file upload). Exploitation can lead to complete compromise of confidentiality, integrity, and availability. The repository has been archived as of May 2025, and no official patch is available; users are advised to migrate to alternative solutions or implement strict server-side file validation and sandboxing.

Affected products

Express.js Connect-Multiparty 0 through 2.2.0

Identifiers

CVE-2022-29623
GHSA-w2xw-44r3-4v9g

Timeline

2022-05-17: disclosed: Published in GitHub Advisory Database
2025-05-14: other: Repository archived and no longer actively maintained

References

https://github.com/expressjs/connect-multiparty

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.