CVE-2022-25297

Name of the Vulnerable Software and Affected Versions drogonframework/drogon versions prior to 1.7.5

Description The issue arises from the unsafe handling of file names during upload using the HttpFile::save() method, potentially allowing attackers to write files to arbitrary locations outside the designated target folder.

Recommendations For versions prior to 1.7.5, update to version 1.7.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the HttpFile::save() method until a patch is available.