CVE-2022-25297: Drogon

High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days.

This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations outside the designated target folder.

Affected products

• Drogon Drogon: before 1.7.5 (fixed in 1.7.5)

Published 2022-02-21. Last modified 2026-06-17.