Medium severity · published Apr 30, 2025
CVE-2022-27562
HCL Domino Volt is affected by an unrestricted upload of a dangerous file type
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HD
HCL Domino Volt · HCL Software
1.0 - 1.0.5 · source: vendor
DL
Domino Leap · Hcltech
1.0 before 1.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-27562
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-27562
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120722
More from HCL Domino Volt
5.4
CVE-2022-42450
HCL Domino Volt is affected by Cross-site scripting (XSS)
5.4
CVE-2022-42449
HCL Domino Volt is affected by an unrestricted upload of a dangerous file type