{"id":"CVE-2022-26521","aliases":["BIT-abantecart-2022-26521","EUVD-2022-31078","GHSA-6x87-qx9j-65qp"],"status":"published","title":"Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by...","description":"Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog\u003eMedia Manager\u003eImages settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.09796,"percentile":0.95605,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-434"],"published":"2022-03-07T00:00:00Z","modified":"2026-10-28T02:30:30Z","exploits":[{"source":"exploitdb","id":"EDB-51058","title":"Abantecart v1.3.2 - Authenticated Remote Code Execution","type":"webapps","platform":"php","date":"2023-03-25","verified":true,"url":"https://www.exploit-db.com/exploits/51058"}],"fixes":[{"ecosystem":"Bitnami","package":"abantecart","fixed_in":["1.3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"abantecart","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]}],"products":[{"vendor":"abantecart","product":"abantecart"}],"references":[{"url":"https://github.com/sartlabs/0days/blob/main/Abantecart/Exploit.txt","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"http://packetstormsecurity.com/files/171487/Abantecart-1.3.2-Remote-Code-Execution.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26521","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6x87-qx9j-65qp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26521.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-26521","description":"Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog\u003eMedia Manager\u003eImages settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).","status":"published","published":"2022-03-07T00:00:00Z","modified":"2024-08-03T05:03:32.753Z","updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-31078","description":"Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog\u003eMedia Manager\u003eImages settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).","status":"published","published":"2022-03-07T00:00:00Z","modified":"2024-08-03T05:03:32Z","updated_at":"2026-11-03T03:25:44.694159Z"}],"ghsa":[{"id":"GHSA-6x87-qx9j-65qp","title":"Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by...","description":"Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog\u003eMedia Manager\u003eImages settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).","status":"published","published":"2022-03-11T00:02:02Z","modified":"2023-03-27T18:30:25Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:54:24.139632Z"}],"nvd":[{"id":"CVE-2022-26521","description":"Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog\u003eMedia Manager\u003eImages settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).","status":"published","published":"2022-03-10T17:47:46.26Z","modified":"2026-06-17T04:35:20.833Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:07:13.7085Z"}],"osv":[{"id":"BIT-abantecart-2022-26521","description":"Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog\u003eMedia Manager\u003eImages settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).","status":"published","published":"2024-03-06T10:50:27.2Z","modified":"2024-03-06T11:25:28.861Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"CVE-2022-26521","description":"Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog\u003eMedia Manager\u003eImages settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type).","status":"published","published":"2022-03-07T00:00:00Z","modified":"2026-10-28T02:30:30.1839475Z","updated_at":"2026-11-02T15:44:24.758293Z"}]}}