{"id":"CVE-2022-27952","details":"An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.","aliases":["GHSA-w8xh-93qh-35vw"],"modified":"2026-08-12T03:51:09.352107583Z","published":"2022-04-12T16:29:04Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27952.json"},"references":[{"type":"WEB","url":"https://www.youtube.com/watch?v=6CfhAxA3xdQ"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27952.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27952"},{"type":"PACKAGE","url":"https://github.com/payloadcms/payload"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/payloadcms/payload","events":[{"introduced":"9b17b5c08c2f730e925ac266eb6ed9a9384ef538"},{"last_affected":"9b17b5c08c2f730e925ac266eb6ed9a9384ef538"}],"database_specific":{"cpe":"cpe:2.3:a:payloadcms:payload:0.15.0:*:*:*:*:node.js:*:*","extracted_events":[{"introduced":"0.15.0"},{"last_affected":"0.15.0"}],"source":"CPE_STRING"}}],"versions":["0.15.0","v0.15.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-27952.json"}}],"schema_version":"1.9.0"}