CVE catalog

CVE-2022-25277

UBUNTU-

[CVE catalog]

Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.42% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Ubuntuprodrupal77.23-1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.24-1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.24-2UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.26-1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.26-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.26-1ubuntu0.1+esm1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.26-1ubuntu0.1+esm2UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.26-1ubuntu0.1+esm3UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.38-1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.41-1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.44-1ubuntu1~16.04.0UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.44-1ubuntu1~16.04.0+esm1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]

Showing 12 observations. All 14 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Ubuntuprodrupal77.23-1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.24-1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.24-2UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.26-1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.26-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.26-1ubuntu0.1+esm1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.26-1ubuntu0.1+esm2UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.26-1ubuntu0.1+esm3UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.38-1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.41-1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.44-1ubuntu1~16.04.0UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.44-1ubuntu1~16.04.0+esm1UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.44-1ubuntu1~16.04.0+esm2UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Ubuntuprodrupal77.44-1ubuntu1~16.04.0+esm3UnknownSource applicability is not established[UBUNTU-CVE-2022-25277]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "drupal7",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "7.23-1",
        "7.24-1",
        "7.24-2",
        "7.26-1",
        "7.26-1ubuntu0.1",
        "7.26-1ubuntu0.1+esm1",
        "7.26-1ubuntu0.1+esm2",
        "7.26-1ubuntu0.1+esm3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-25277",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-25277",
      "provider_updated_at": "2025-09-08T16:50:05Z",
      "applicability_unknown": true
    },
    {
      "name": "drupal7",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "7.38-1",
        "7.41-1",
        "7.44-1ubuntu1~16.04.0",
        "7.44-1ubuntu1~16.04.0+esm1",
        "7.44-1ubuntu1~16.04.0+esm2",
        "7.44-1ubuntu1~16.04.0+esm3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-25277",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-25277",
      "provider_updated_at": "2025-09-08T16:50:05Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]