Critical severity9.8NVD Advisory· Published Apr 12, 2022· Updated Jul 9, 2026

CVE-2022-27260

Description

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
buttercmsnpm	<= 1.2.8	—

Affected products

Buttercms/Buttercms2 versions
cpe:2.3:a:buttercms:buttercms:1.2.8:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:buttercms:buttercms:1.2.8:*:*:*:*:node.js:*:*
- (no CPE)
ghsa-coords
pkg:npm/buttercms
Range: <= 1.2.8

Patches

Vulnerability mechanics

References

share.getcloudapp.com/nOuR70WBnvdExploitThird Party Advisory
www.youtube.com/watchnvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-3v5x-qjrp-q2hqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-27260ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000