CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-27952
Critical (9.8) in payloadcms payload. EPSS 2.3% chance of exploitation in the next 30 days. Fixed in payload 0.15.1.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.
Severity
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-434
- Published
- Modified
- Record from
- the NVD, synced
Affected
- payloadcms:payload
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w8xh-93qh-35vw | npm | payload | <0.15.1 | 0.15.1 |