Critical severity9.8NVD Advisory· Published Oct 25, 2022· Updated Jun 17, 2026

CVE-2022-41711

Description

Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
badaso/corePackagist	< 2.6.1	2.6.1

Affected products

Uatech/Badaso2 versions
cpe:2.3:a:uatech:badaso:2.6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:uatech:badaso:2.6.0:*:*:*:*:*:*:*
- (no CPE)range: 2.6.0
ghsa-coords
pkg:composer/badaso/core
Range: < 2.6.1

Patches

Vulnerability mechanics

References

fluidattacks.com/advisories/harlow/nvdExploitIssue TrackingThird Party Advisory
github.com/advisories/GHSA-fwvc-9xhj-26v5ghsaADVISORY
github.com/uasoft-indonesia/badaso/issues/802nvdIssue TrackingThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2022-41711ghsaADVISORY
fluidattacks.com/advisories/harlowghsaWEB
github.com/uasoft-indonesia/badaso/commit/22250eca7c364d991ce9e0a723941eae4889d6f9ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000