CVE-2022-38296

CRITICAL

Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS5.1%
Percentile92th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-434: Unrestricted Upload of File with Dangerous Type

Application allows file uploads without validating type, enabling upload of executable code or web shells.

Related Attack Patterns (CAPEC)
CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
via CWE-434

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Cuppa CMS v1.0 contains a critical arbitrary file upload vulnerability in the File Manager, allowing attackers to upload malicious files and potentially gain remote code execution.

BSID: BS-2022-GLOBAL-330741-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-38296?
Cuppa CMS v1.0 contains a critical arbitrary file upload vulnerability in the File Manager, allowing attackers to upload malicious files and potentially gain remote code execution.
What is the CVSS score for CVE-2022-38296?
CVE-2022-38296 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 5.1%.
Is CVE-2022-38296 actively exploited?
No confirmed active exploitation of CVE-2022-38296 as of 2026-05-30.
How do I remediate CVE-2022-38296?
Priority: IMMEDIATE.
What systems are affected by CVE-2022-38296?
CVE-2022-38296 affects Cuppacms Cuppacms.
Vulnerability Details
CVE IDCVE-2022-38296
BSIDBS-2022-GLOBAL-330741-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2022-09-12
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
Unrestricted Upload of File with Dangerous Type
SourceNVD
Official Description

Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability exists in the File Manager functionality of Cuppa CMS v1.0, where file type validation is insufficient, enabling attackers to upload files with malicious content.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Cuppacms Cuppacms 1.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1494 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashc9d0d684ccd75b19ba0585f0092a778f0fd8eed0f22377e7b3763a127201bdd5fbf809cc5d752dffc3c9f44407dc17b08408253cd171248af1aa994c478f89af
Related CVEs affecting Cuppacms
CVE-2022-27984 9.8 CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the... CVE-2022-25495 9.8 The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allow... CVE-2018-19559 9.8 CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/fu... CVE-2022-25498 9.8 CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnera... CVE-2022-27985 9.8 CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /ad...
View all Cuppacms CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →