CVE-2022-26521

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-26521

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26521.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-26521

Aliases

BIT-abantecart-2022-26521

Published

2022-03-10T17:47:46.260Z

Modified

2026-03-14T11:29:50.830899Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).

References

Affected packages

Git / github.com/abantecart/abantecart-src

Affected ranges

Type

GIT

Repo

https://github.com/abantecart/abantecart-src

Events

Introduced

Last affected

3c7705381efb8be7e209e528464f20d732979291

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.3.2"
        }
    ]
}

Affected versions

1.*

1.2.10

1.2.11

1.2.12

1.2.13

1.2.14

1.2.15

1.2.16

1.2.8

1.2.9

1.3.0

1.3.0.beta

1.3.1

1.3.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26521.json"