CVE-2022-27249

PoC —

CVSS 3.1

8.8 high

EPSS

5%p92

Published

Apr 3, 2022 (Apr 3, 2022)

Modified

Jun 17, 2026

Description

An unrestricted file upload vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to execute arbitrary code by using UploadDwg to upload a crafted aspx file to the web root, and then visiting the URL for this aspx resource.

Vendors: idearespa
Products: reftree
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.9%)

In the news0 stories

No ingested article mentions this CVE yet.