What’s Vulnerable › Vulnerabilities

CVE-2022-25299: Arbitrary File Write

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-18 · updated 2026-06-17
• Weakness: CWE-552

Description

This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder.

Affected products

• Cesanta Mongoose: before 7.6 — fixed in 7.6

How to fix

Upgrade to a fixed version: Cesanta Mongoose 7.6. Check the vendor advisory for mitigations.

References

• https://github.com/cesanta/mongoose/commit/c65c8fdaaa257e0487ab0aaae9e8f6b439335945
• https://snyk.io/vuln/SNYK-UNMANAGED-CESANTAMONGOOSE-2404180
• https://github.com/cesanta/mongoose/commit/c65c8fdaaa257e0487ab0aaae9e8f6b439335945
• https://snyk.io/vuln/SNYK-UNMANAGED-CESANTAMONGOOSE-2404180

Get alerted when CVE-2022-25299 or the next vulnerability affects your stack