{"id":"CVE-2022-41711","aliases":["EUVD-2022-7093","GHSA-fwvc-9xhj-26v5"],"status":"published","title":"Badaso vulnerable to Remote Code Execution via malicious file upload","description":"Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0208,"percentile":0.81677,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434"],"published":"2022-10-25T00:00:00Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Packagist","package":"badaso/core","fixed_in":["2.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"badaso/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"badaso/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1"}]}],"versions":["1.0.0","1.0.0-alpha.1","1.0.0-alpha.10","1.0.0-alpha.11","1.0.0-alpha.12","1.0.0-alpha.13","1.0.0-alpha.14","1.0.0-alpha.15","1.0.0-alpha.16","1.0.0-alpha.17","1.0.0-alpha.18","1.0.0-alpha.19","1.0.0-alpha.2","1.0.0-alpha.20","1.0.0-alpha.21","1.0.0-alpha.22","1.0.0-alpha.23","1.0.0-alpha.24","1.0.0-alpha.25","1.0.0-alpha.26","1.0.0-alpha.27","1.0.0-alpha.28","1.0.0-alpha.29","1.0.0-alpha.3","1.0.0-alpha.30","1.0.0-alpha.31","1.0.0-alpha.32","1.0.0-alpha.33","1.0.0-alpha.34","1.0.0-alpha.35","1.0.0-alpha.36","1.0.0-alpha.37","1.0.0-alpha.38","1.0.0-alpha.39","1.0.0-alpha.4","1.0.0-alpha.40","1.0.0-alpha.5","1.0.0-alpha.6","1.0.0-alpha.7","1.0.0-alpha.8","1.0.0-alpha.9","1.0.0-rc","1.0.0-rc.1","1.0.0-rc.10","1.0.0-rc.11","1.0.0-rc.12","1.0.0-rc.13","1.0.0-rc.14","1.0.0-rc.15","1.0.0-rc.2","1.0.0-rc.3","1.0.0-rc.4","1.0.0-rc.5","1.0.0-rc.6","1.0.0-rc.7","1.0.0-rc.8","1.0.0-rc.9","1.0.1","1.0.2","2.0.0","2.0.0-alpha","2.0.0-rc","2.0.0-rc.1","2.0.0-rc.10","2.0.0-rc.11","2.0.0-rc.12","2.0.0-rc.13","2.0.0-rc.14","2.0.0-rc.2","2.0.0-rc.3","2.0.0-rc.4","2.0.0-rc.5","2.0.0-rc.6","2.0.0-rc.7","2.0.0-rc.8","2.0.0-rc.9","2.0.1","2.0.2","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.4.0","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.14","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0"]}],"products":[{"vendor":"uasoft","product":"badaso"},{"vendor":"uatech","product":"badaso"}],"references":[{"url":"https://fluidattacks.com/advisories/harlow/","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","advisory"]},{"url":"https://github.com/uasoft-indonesia/badaso/issues/802","tags":["x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41711","tags":["advisory"]},{"url":"https://github.com/uasoft-indonesia/badaso/commit/22250eca7c364d991ce9e0a723941eae4889d6f9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fwvc-9xhj-26v5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41711.json","tags":["advisory"]},{"url":"https://fluidattacks.com/advisories/harlow","tags":["web"]},{"url":"https://github.com/uasoft-indonesia/badaso","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-41711","description":"Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.","status":"published","published":"2022-10-25T00:00:00Z","modified":"2025-05-07T19:32:44.015Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:28.038197Z"}],"euvd":[{"id":"EUVD-2022-7093","description":"Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.","status":"published","published":"2022-10-25T00:00:00Z","modified":"2025-05-07T19:32:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:52.670412Z"}],"ghsa":[{"id":"GHSA-fwvc-9xhj-26v5","title":"Badaso vulnerable to Remote Code Execution via malicious file upload","description":"Badaso allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.","status":"published","published":"2022-10-26T12:00:31Z","modified":"2023-01-30T05:03:15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:36:28.424013Z"}],"nvd":[{"id":"CVE-2022-41711","description":"Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.","status":"published","published":"2022-10-25T21:15:49.15Z","modified":"2026-06-17T05:03:41.31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"CVE-2022-41711","description":"Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.","status":"published","published":"2022-10-25T00:00:00Z","modified":"2026-10-28T02:30:36.593144477Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"GHSA-fwvc-9xhj-26v5","title":"Badaso vulnerable to Remote Code Execution via malicious file upload","description":"Badaso allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.","status":"published","published":"2022-10-26T12:00:31Z","modified":"2024-02-16T08:25:02.930767Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:46:47.119724Z"}]}}