CVE-2022-25277

Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.

• CWE-434
• CWE-434

• https://www.drupal.org/sa-core-2022-014Vendor Advisory
• https://www.drupal.org/sa-core-2022-014Vendor Advisory

Published

Apr 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25270The Quick Edit module does not properly check entity access …6.5
• CVE-2022-25271Drupal core's form API has a vulnerability where certain con…7.5
• CVE-2022-25273Drupal core's form API has a vulnerability where certain con…7.5
• CVE-2022-25274Drupal 9.3 implemented a generic entity access API for entit…5.4
• CVE-2022-25275In some situations, the Image module does not correctly chec…7.5
• CVE-2022-25276The Media oEmbed iframe route does not properly validate the…6.1
• CVE-2022-25278Under certain circumstances, the Drupal core form API evalua…6.5
• CVE-2022-2528In affected versions of Octopus Deploy it is possible to upl…6.5
• CVE-2022-2529sflow decode package does not employ sufficient packet sanit…7.5
• CVE-2022-25290WatchGuard Firebox and XTM appliances allow an authenticated…6.5
• CVE-2022-25291An integer overflow in WatchGuard Firebox and XTM appliances…8.8
• CVE-2022-25292A wgagent stack-based buffer overflow in WatchGuard Firebox …8.8