CVE-2022-31366

HIGH 7.2EPSS 1.2%

An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execute arbitrary code via a crafted UNL file.

CVSS v3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.15% chance of exploitation in the next 30 days, 65th percentile
Published: 2022-10-20
Updated: 2026-07-09

Proof-of-concept exploits (1)

https://erpaciocco.github.io/2022/eve-ng-rce/

References

Related