CVE-2022-27140

CVE-2022-27140 affects the express-fileupload module (version 1.3.1). The vulnerability arises from improper validation in the file upload mechanism, allowing an attacker to upload a crafted PHP file and potentially execute arbitrary code. Vendor notes this behavior can occur only with intentiona...

CVE-2022-27261

CVE-2022-27261 describes an arbitrary file write vulnerability in Express-FileUpload v1.3.1. The issue allows uploading multiple files with the same name, leading to overwriting existing files on the web application server. Connected documents corroborate the affected product/version and impact, ...

CVE-2020-7699

CVE-2020-7699 affects the Node.js Express Fileupload package: versions prior to 1.1.8 are vulnerable when the parseNested option is enabled. The root cause is a prototype pollution issue that can enable denial of service or arbitrary code execution via specially crafted HTTP requests. A fix is av...