CVE-2022-24837

HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes and affects all upload backends, except Lutim and imgur. This issue is patched in version 1.9.3 by replacing the filename generation with UUIDv4. If you cannot upgrade to HedgeDoc 1.9.3, it is possible to block POST requests to `/uploadimage`, which will disable future uploads.

• CWE-200
• CWE-434

• https://github.com/hedgedoc/hedgedoc/commit/9e2f9e21e904c4a319e84265da7ef03b0a8e343aPatch, Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-q6vv-2q26-j7rxPatch, Third Party Advisory
• https://github.com/node-formidable/formidable/issues/808Issue Tracking, Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/commit/9e2f9e21e904c4a319e84265da7ef03b0a8e343aPatch, Third Party Advisory
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-q6vv-2q26-j7rxPatch, Third Party Advisory
• https://github.com/node-formidable/formidable/issues/808Issue Tracking, Third Party Advisory

Published

Apr 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24830OpenClinica is an open source software for Electronic Data C…9.8
• CVE-2022-24831OpenClinica is an open source software for Electronic Data C…9.8
• CVE-2022-24832GoCD is an open source a continuous delivery server. The bun…6.8
• CVE-2022-24833PrivateBin is minimalist, open source online pastebin clone …6.1
• CVE-2022-24834Redis is an in-memory database that persists on disk. A spec…8.8
• CVE-2022-24836Nokogiri is an open source XML and HTML library for Ruby. No…7.5
• CVE-2022-24838Nextcloud Calendar is a calendar application for the nextclo…9.8
• CVE-2022-24839org.cyberneko.html is an html parser written in Java. The fo…7.5
• CVE-2022-2484 The signature check in the Nokia ASIK AirScale system mod…7.8
• CVE-2022-24840django-s3file is a lightweight file upload input for Django …9.8
• CVE-2022-24841fleetdm/fleet is an open source device management, built on …8.1
• CVE-2022-24842MinIO is a High Performance Object Storage released under GN…8.8