Search for vulnerabilities
Vulnerability details: VCID-n1fg-3v4n-pbdr
Vulnerability ID VCID-n1fg-3v4n-pbdr
Aliases CVE-2022-25277
GHSA-6955-67hm-vjjq
GMS-2022-3361
Summary Drupal core arbitrary PHP code execution Drupal core sanitizes filenames with dangerous extensions upon upload and strips leading and trailing dots from filenames to prevent uploading server configuration files. However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
epss 0.00183 https://api.first.org/data/v1/epss?cve=CVE-2022-25277
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-6955-67hm-vjjq
cvssv3.1 7.2 https://github.com/drupal/core
generic_textual HIGH https://github.com/drupal/core
cvssv3.1 7.2 https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17
generic_textual HIGH https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17
cvssv3.1 7.2 https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a
generic_textual HIGH https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a
cvssv3.1 7.2 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml
generic_textual HIGH https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml
cvssv3.1 7.2 https://nvd.nist.gov/vuln/detail/CVE-2022-25277
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-25277
cvssv3.1 7.2 https://www.drupal.org/sa-core-2022-014
generic_textual HIGH https://www.drupal.org/sa-core-2022-014
ssvc Track https://www.drupal.org/sa-core-2022-014
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-25277
https://github.com/drupal/core
https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17
https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a
https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml
https://nvd.nist.gov/vuln/detail/CVE-2022-25277
https://www.drupal.org/sa-core-2022-014
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
GHSA-6955-67hm-vjjq https://github.com/advisories/GHSA-6955-67hm-vjjq
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/drupal/core
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-25277
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://www.drupal.org/sa-core-2022-014
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-03T18:41:13Z/ Found at https://www.drupal.org/sa-core-2022-014
Exploit Prediction Scoring System (EPSS)
Percentile 0.37435
EPSS Score 0.00159
Published At Aug. 16, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:03:20.222331+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-6955-67hm-vjjq/GHSA-6955-67hm-vjjq.json 37.0.0