Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
[
{
"product": "express-cart",
"vendor": "HackerOne",
"versions": [
{
"status": "affected",
"version": "1.1.7"
}
]
}
]