Withdrawn: Code execution via SVG file upload in tiddlywiki

CRÍTICO 9.8CVE-2022-29351 · GHSA-cr9c-rhq6-vh53 · Published 16/05/2022 · updated 09/07/2026

Em resumo

CVE-2022-29351 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta tiddlywiki5 (tiddlywiki), tiddlywiki.
Chance de exploração nos próximos 30 dias (EPSS): 2.7%, maior que 85.8% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
tiddlywiki5 tiddlywiki	`= 5.2.2`	No fix yet
tiddlywiki npm	`≤ 5.2.2`	No fix yet

Description

Withdrawn Advisory

This advisory has been withdrawn because it has been found to not be valid. Please see the issue here for more information.

Original Description

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.

NVD description

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here.

References

nvd.nist.gov/vuln/detail/CVE-2022-29351 · ADVISORY
Jermolene/TiddlyWiki5 · WEB
Jermolene/TiddlyWiki5 · PACKAGE
jimcola99/corruptsvgfile · WEB
youtube.com/watch · WEB
tiddlywiki5.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free