CVE-2022-23626: Insufficient file checks in m1k1o/blog

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-08 · updated 2026-06-17
Weakness: CWE-20

Description

m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Affected products

m1k1o blog: before 1.4 — fixed in 1.4

How to fix

Upgrade to a fixed version: m1k1o blog 1.4. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/167235/m1k1os-Blog-1.3-Remote-Code-Execution.html
https://github.com/m1k1o/blog/commit/6f5e59f1401c4a3cf2e518aa85b231ea14e8a2ef
https://github.com/m1k1o/blog/security/advisories/GHSA-wmqj-5v54-24x4
http://packetstormsecurity.com/files/167235/m1k1os-Blog-1.3-Remote-Code-Execution.html
https://github.com/m1k1o/blog/commit/6f5e59f1401c4a3cf2e518aa85b231ea14e8a2ef
https://github.com/m1k1o/blog/security/advisories/GHSA-wmqj-5v54-24x4

Get alerted when CVE-2022-23626 or the next vulnerability affects your stack