CVE-2022-25277

CVE-2022-25277 is a critical vulnerability in Drupal core that could allow remote code execution on Apache web servers. It arises from an insufficient filename sanitization process, specifically when a site is configured to permit .htaccess file uploads, bypassing default security protections. This vulnerability carries a CVSS score of 7.2 (HIGH), indicating a high impact on confidentiality, integrity, and availability, with a network attack vector and low attack complexity, although it requires administrator privileges to configure the vulnerable file upload settings. While there is no known active exploitation or public exploit code, the vulnerability has garnered some community discussion and media coverage, suggesting awareness within the security community.