CVE-2022-23626

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-252

Affected software

No affected versions have been published.

Timeline

Published: Feb 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-236276.8ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in A CVE-2022-236285.3OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains CVE-2022-23634.6A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Parking Management System 1.0. Affected by thi CVE-2022-236307.5Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that veri CVE-2022-236319.8superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows i CVE-2022-236327.5Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security (TLS) configur CVE-2022-236335.9Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In t CVE-2022-236345.9Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response bo CVE-2022-236357.5Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerabl CVE-2022-236368.1Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance a CVE-2022-236375.4K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cross-Site-Scripting (XS CVE-2022-236386.1svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library p