CVE-2022-25591

9.1 criticalEPSS 2.7%

Critical (9.1) in blogengine blogengine.net. EPSS 2.7% chance of exploitation in the next 30 days.

BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS: 2.7% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2022-05-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

blogengine:blogengine.net

References

https://blogengine.io/
https://www.0xlanks.me/blog/cve-2022-25591-advisory/
https://blogengine.io/
https://www.0xlanks.me/blog/cve-2022-25591-advisory/

Check your stack JSON