{"answers":{"affected":"2 open source packages ship an affected version, including fof/upload. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-30999 exists.","fix":"Upgrade fof/upload to 1.2.3 or later.","what":"CVE-2022-30999 is a high-severity cross-site scripting vulnerability in FriendsOfFlarum upload, published on 25 May 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2022-30999 and fix it if it is affected.\n\nWhat it is: CVE-2022-30999 is a high-severity cross-site scripting vulnerability in FriendsOfFlarum upload, published on 25 May 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-30999 exists.\n\nAffected packages and fixed versions:\n- fof/upload (Packagist): affected all versions; fixed in 1.2.3\n- fof/upload (Packagist): affected all versions; fixed in 1.2.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-30999/ (Markdown: https://insights.sbomify.com/CVE-2022-30999/index.md)","id":"CVE-2022-30999","markdown":"https://insights.sbomify.com/CVE-2022-30999/index.md","name":"CVE-2022-30999","record":{"aliases":["GHSA-fm53-mpmp-7qw2"],"analysis":{"component_type":"cms_plugin","fix_type":"patch","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"Flarum upload extension","requires_auth":"low_privilege","summary":"Attackers can execute arbitrary JavaScript via unsanitized SVG uploads in FoF Upload, potentially leaking or modifying user data.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"upload","vendor":"friendsofflarum"}],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Possible cross-site scripting attack via unsanitized SVG files in FoF Upload","id":"CVE-2022-30999","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"xss","year":"2022"},"n_packages":2,"n_references":4,"next":{"headline":"CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend","id":"CVE-2022-31000"},"packages":[{"ecosystem":"Packagist","fixed":["1.2.3"],"introduced":["0"],"last_affected":[],"package":"fof/upload","purl":null,"source":"GHSA-fm53-mpmp-7qw2"},{"ecosystem":"Packagist","fixed":["1.2.3"],"introduced":["0"],"last_affected":[],"package":"fof/upload","purl":"pkg:composer/fof/upload","source":"GHSA-fm53-mpmp-7qw2"}],"prev":{"headline":"SQL injection in Homepage Product Organizer for WooCommerce (WordPress plugin)","id":"CVE-2022-30998"},"products":["upload"],"published":"2022-05-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-04-22","vendors":["FriendsOfFlarum"]},"summary":"Attackers can execute arbitrary JavaScript via unsanitized SVG uploads in FoF Upload, potentially leaking or modifying user data.","url":"https://insights.sbomify.com/CVE-2022-30999/"}