Critical severity9.8NVD Advisory· Published Feb 18, 2022· Updated Jun 17, 2026

CVE-2022-25299

Description

This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cesanta/Mongoose3 versions
cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*range: <7.6
- (no CPE)
- (no CPE)range: <7.6

Patches

Vulnerability mechanics

References

github.com/cesanta/mongoose/commit/c65c8fdaaa257e0487ab0aaae9e8f6b439335945nvdPatchThird Party Advisory
snyk.io/vuln/SNYK-UNMANAGED-CESANTAMONGOOSE-2404180nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000