Withdrawn: Code execution via SVG file upload in tiddlywiki

KRITISCH 9.8CVE-2022-29351 · GHSA-cr9c-rhq6-vh53 · Published 16/05/2022 · updated 09/07/2026

Kurz gesagt

CVE-2022-29351 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in tiddlywiki5 (tiddlywiki), tiddlywiki.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.7%, höher als bei 85.8% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
tiddlywiki5 tiddlywiki	`= 5.2.2`	No fix yet
tiddlywiki npm	`≤ 5.2.2`	No fix yet

Description

Withdrawn Advisory

This advisory has been withdrawn because it has been found to not be valid. Please see the issue here for more information.

Original Description

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.

NVD description

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here.

References

nvd.nist.gov/vuln/detail/CVE-2022-29351 · ADVISORY
Jermolene/TiddlyWiki5 · WEB
Jermolene/TiddlyWiki5 · PACKAGE
jimcola99/corruptsvgfile · WEB
youtube.com/watch · WEB
tiddlywiki5.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free