CVE-2022-27262
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file.
Risk Assessment
An attacker can upload a malicious file, potentially leading to server compromise and breach of data confidentiality, integrity, and availability.
Recommendation
Immediately update Skipper to the latest version and implement file type validation and size restrictions in the upload module.
Other vulnerabilities in Skipper
See all- CVE-2026-65604High
Skipper has an incomplete fix for CVE-2026-50197 where oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence policies. When the request body exceeds the maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates an empty parsed_body, allowing forbidden actions.
- CVE-2026-50197High
Vulnerability in Skipper (HTTP router and reverse proxy) before version 0.26.10 allows bypassing request body inspection for HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests without content-length header via OpenPolicyAgent integration. Attacker can send malicious data that is not inspected but reaches the upstream service.
Original NVD description (English source)
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file.