onyx --cves cve-2022-27139

CVE-2022-27139

score: <0.1
cvss: 9.8
epss: 4.0%
published: 2022-04-12
kev added: —
first seen: 2026-10-21

Ghost v4.39.0 contains an arbitrary file upload vulnerability in the file upload module caused by lack of validation for SVG files, letting authenticated users upload potentially malicious SVGs, exploit requires user authentication.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2022-04-12 Published
2026-10-21 Tracked by Onyx
2026-10-21 Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-434

References 2

https://youtu.be/FCqWEvir2wE
http://ghost.org/docs/security/#privilege-escalation-attacks