CVE-2022-25591: Blogengine Blogengine.net

Critical severity, CVSS 9.1. EPSS: 2.7% chance of exploitation in the next 30 days.

BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request.

Affected products

• Blogengine Blogengine.net: version 3.3.8.0 only

Published 2022-05-13. Last modified 2026-06-17.