CVE-2022-0528: Incorrect Authorization in @uppy/companion
Summary
CVE-2022-0528: Incorrect Authorization in @uppy/companion. Affects @uppy/companion versions < 3.3.1. Fixed in 3.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @uppy/companion package is a component of the Uppy file uploader library for JavaScript. It provides server-side functionality for handling file uploads. The package allows users to upload files to a server using various methods, including URL upload. However, prior to version 3.3.1, @uppy/companion is vulnerable to an incorrect authorization issue.
Vulnerability Detail
The vulnerability in @uppy/companion allows a user with URL upload access to enumerate internal companion server networks, send local webservers files to the destination server, and download them. This can be exploited if the files have guessable and regular names. The impact of this vulnerability can be significant, as an attacker could potentially gain unauthorized access to sensitive files on the server.
How To Fix
Latest published version: 7.2.0 as of 22 Oct 2026
npm install @uppy/companion@7.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.1
This is the first release that contains the fix.
npm install @uppy/companion@3.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update to the patched version of @uppy/companion to mitigate the risk.
Conclusion
In conclusion, the @uppy/companion package prior to version 3.3.1 is vulnerable to an incorrect authorization issue. To mitigate the risk, it is recommended to update to the patched version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @uppy/companion →
FAQ
@uppy/companion is a server-side component of the Uppy file uploader library for JavaScript. It provides functionality for handling file uploads.
The vulnerability allows unauthorized access to sensitive files on the server, potentially exposing sensitive information.
To fix this vulnerability, update to version 3.3.1 or later of @uppy/companion.
No, there is no known workaround. Updating to the patched version is necessary.
You can find more information about this vulnerability in the GitHub Advisory Database.
Related vulnerabilities
Recent vulnerabilities recorded for @uppy/companion.
