CVE-2022-45896: Planetestream Planet Estream

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. Upload2.ashx can be used, or Ajax.asmx/ProcessUpload2. This leads to remote code execution.

Affected products

• Planetestream Planet Estream: before 6.72.10.07 (fixed in 6.72.10.07)

Published 2022-12-25. Last modified 2026-06-17.