CVE-2022-27260

CriticalCVSS 9.8

Published: 12/04/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.92%

85th percentile - higher than 85% of all known CVEs

Summary

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

Risk Assessment

Attackers can gain full server control, steal data, or install malware, posing a critical security risk to the organization.

Recommendation

Immediately update ButterCMS to the latest version and implement file type validation and antivirus scanning for uploaded files.

Original NVD description (English source)

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.