Withdrawn: Code execution via SVG file upload in tiddlywiki

CRITICAL 9.8CVE-2022-29351 · GHSA-cr9c-rhq6-vh53 · Published 16/05/2022 · updated 09/07/2026

In short

CVE-2022-29351 is a CRITICAL (CVSS 9.8) vulnerability affecting tiddlywiki5 (tiddlywiki), tiddlywiki.
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 85.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
tiddlywiki5 tiddlywiki	`= 5.2.2`	No fix yet
tiddlywiki npm	`≤ 5.2.2`	No fix yet

Description

Withdrawn Advisory

This advisory has been withdrawn because it has been found to not be valid. Please see the issue here for more information.

Original Description

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.

NVD description

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here.

References

nvd.nist.gov/vuln/detail/CVE-2022-29351 · ADVISORY
Jermolene/TiddlyWiki5 · WEB
Jermolene/TiddlyWiki5 · PACKAGE
jimcola99/corruptsvgfile · WEB
youtube.com/watch · WEB
tiddlywiki5.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free