CVE-2022-25277

score

<0.1

cvss

7.2

epss

1.4%

published

2023-04-26

kev added

—

first seen

2026-10-21

Drupal core contains a filename sanitization issue caused by improper handling of dangerous extensions and leading/trailing dots, letting attackers upload files with htaccess extension to bypass protections and potentially execute remote code, exploit requires site configuration to allow htaccess uploads.