CVE-2022-27261: Express-Fileupload Project Express-Fileupload

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server.

Affected products

• Express-Fileupload Project Express-Fileupload: version 1.3.1 only

Published 2022-04-12. Last modified 2026-06-17.