description: Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
problem types: Path Traversal (CWE-22)
affected:
{
product: express-cart
vendor: HackerOne
versions:
status: affected, version: 1.1.7
}