{"action":"Upgrade xpressengine/xpressengine to 3.0.15 or later.","affected":[{"fixed":"3.0.15","introduced":"0"}],"component":"xpressengine/xpressengine","cve_ids":["CVE-2021-26642"],"ecosystem":"Packagist","epss":0.0121,"exploited":false,"fixed_versions":["3.0.15"],"ghsa_id":"GHSA-8r5j-22j5-w4cm","id":"tcs_01M5KEZ9B0Y2CPQQZZ0081VAC9","modified_at":"2023-11-08T04:05:21.787797Z","published_at":"2023-01-20T18:30:22Z","references":["https://osv.dev/vulnerability/GHSA-8r5j-22j5-w4cm","https://nvd.nist.gov/vuln/detail/CVE-2021-26642","https://github.com/xpressengine/xpressengine/issues/1366","https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67125"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-8r5j-22j5-w4cm","url":"https://osv.dev/vulnerability/GHSA-8r5j-22j5-w4cm"}],"summary":"XpressEngine vulnerable to Unrestricted Upload of File with Dangerous Type"}