CVE-2022-27260

Critical · CVSS 9.8

ButterCMS — Arbitrary File Upload leading to Remote Code Execution (SVG upload)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-434

Description

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.

Search profile — drives PoC discovery

Symbols file upload componentcrafted SVG filebuttercms-jsv1.2.8

Keywords CVE-2022-27260ButterCMSarbitrary file uploadSVG upload RCEbuttercms-js 1.2.8CWE-434ButterCMS SVG exploitButterCMS file upload vulnerability

Versions: v1.2.8

References

https://github.com/ButterCMS/buttercms-js
https://share.getcloudapp.com/nOuR70WB
https://www.youtube.com/watch?v=Tw8OhtVd-mE
http://buttercms.com
https://github.com/ButterCMS/buttercms-js
https://share.getcloudapp.com/nOuR70WB
https://www.youtube.com/watch?v=Tw8OhtVd-mE

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T06:30:39.000Z