Possible cross-site scripting attack via unsanitized SVG files in FoF Upload

MEDIO 5.4CVE-2022-30999 · GHSA-fm53-mpmp-7qw2 · Published 02/06/2022 · updated 17/06/2026

In breve

CVE-2022-30999 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda fof/upload, upload (friendsofflarum).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 69.8% delle vulnerabilità.
Correzione: aggiornare a 1.2.3 o successiva.

Package	Affected versions	Patched versions
fof/upload Packagist	`< 1.2.3`	`1.2.3`
upload friendsofflarum	`< 1.2.3`	`1.2.3`

Description

Impact

If FoF Upload is configured to allow the uploading of SVG files (image/svg+xml), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker.

This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously.

Patches

This has been patched with v1.2.3, which now sanitizes uploaded SVG files.

Workarounds

Upgrade to 1.2.3 (requires Flarum 1.2 or later), or remove the ability for users to upload SVG files through FoF Upload.

References

Thank you to Safwat Refaat for the responsible disclosure of this vulnerability.

NVD description

FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload.

References

FriendsOfFlarum/upload security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-30999 · ADVISORY
FriendsOfFlarum/upload · WEB
FriendsOfFlarum/upload#318 · WEB
FriendsOfFlarum/upload · PACKAGE
FriendsOfFlarum/upload release 1.2.3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

fof/upload

Packagist

< 1.2.3

1.2.3

upload

friendsofflarum

< 1.2.3

1.2.3

Description

Impact

If FoF Upload is configured to allow the uploading of SVG files (image/svg+xml), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker.

Patches

This has been patched with v1.2.3, which now sanitizes uploaded SVG files.

Workarounds

Upgrade to 1.2.3 (requires Flarum 1.2 or later), or remove the ability for users to upload SVG files through FoF Upload.

References

Thank you to Safwat Refaat for the responsible disclosure of this vulnerability.

NVD description