What’s Vulnerable › Vulnerabilities

CVE-2022-1033: Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-23 · updated 2026-06-17
• Weakness: CWE-434

Description

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.

Affected products

• crater-invoice/crater: before 6.0.6 — fixed in 6.0.6

How to fix

Upgrade to a fixed version: crater-invoice/crater 6.0.6. Check the vendor advisory for mitigations.

References

• https://github.com/crater-invoice/crater/commit/88035ea49082f7053a37ef07bf3587e09d9d22b4
• https://huntr.dev/bounties/4d7d4fc9-e0cf-42d3-b89c-6ea57a769045
• https://github.com/crater-invoice/crater/commit/88035ea49082f7053a37ef07bf3587e09d9d22b4
• https://huntr.dev/bounties/4d7d4fc9-e0cf-42d3-b89c-6ea57a769045

Get alerted when CVE-2022-1033 or the next vulnerability affects your stack