{"action":"Upgrade badaso/core to 2.6.1 or later.","affected":[{"fixed":"2.6.1","introduced":"0"}],"component":"badaso/core","cve_ids":["CVE-2022-41711"],"ecosystem":"Packagist","epss":0.0208,"exploited":false,"fixed_versions":["2.6.1"],"ghsa_id":"GHSA-fwvc-9xhj-26v5","id":"tcs_01M5KF249SMFYN6EBETYC61ZT7","modified_at":"2024-02-16T08:25:02.930767Z","published_at":"2022-10-26T12:00:31Z","references":["https://osv.dev/vulnerability/GHSA-fwvc-9xhj-26v5","https://nvd.nist.gov/vuln/detail/CVE-2022-41711","https://github.com/uasoft-indonesia/badaso/issues/802","https://github.com/uasoft-indonesia/badaso/commit/22250eca7c364d991ce9e0a723941eae4889d6f9","https://fluidattacks.com/advisories/harlow","https://github.com/uasoft-indonesia/badaso"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-fwvc-9xhj-26v5","url":"https://osv.dev/vulnerability/GHSA-fwvc-9xhj-26v5"}],"summary":"Badaso vulnerable to Remote Code Execution via malicious file upload"}