CVE-2022-30110 Cross-site Scripting in Jirafeau

What is CVE-2022-30110?

CVE-2022-30110 is a medium-severity cross-site scripting vulnerability in n/a, published on 17 May 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The file preview functionality in Jirafeau < 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file will be executed in the users' browser.

Weakness: CWE-79

Which versions are affected by CVE-2022-30110?

2 open source packages ship an affected version, including mojo42/jirafeau. It affects 1 product.

Products include Jirafeau Jirafeau.

How do I fix CVE-2022-30110?

Upgrade mojo42/jirafeau to 4.4.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-30110 being exploited?

There is no known exploitation of CVE-2022-30110 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-11349 Cross-site request forgery in n/a High 8.8
• CVE-2026-1466 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau Medium 6.1
• CVE-2025-7066 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau Medium 6.1
• CVE-2024-12326 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau Medium 6.1
• CVE-2018-11350 Cross-site scripting in n/a Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j2xf-p274-g8cc.