CVE-2022-29622

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.

• CWE-434

• https://github.com/node-formidable/formidable/issues/856Issue Tracking, Third Party Advisory
• https://github.com/node-formidable/formidable/issues/862Exploit, Issue Tracking, Third Party Advisory
• https://github.com/strapi/strapi/issues/20189
• https://medium.com/%40zsolt.imre/is-cybersecurity-the-next-supply-chain-vulnerability-9a00de745022
• https://www.youtube.com/watch?v=C6QPKooxhAoExploit, Third Party Advisory
• https://github.com/node-formidable/formidable/issues/856Issue Tracking, Third Party Advisory
• https://github.com/node-formidable/formidable/issues/862Exploit, Issue Tracking, Third Party Advisory
• https://github.com/strapi/strapi/issues/20189
• https://medium.com/%40zsolt.imre/is-cybersecurity-the-next-supply-chain-vulnerability-9a00de745022
• https://www.youtube.com/watch?v=C6QPKooxhAoExploit, Third Party Advisory

Published

May 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29616SAP Host Agent, SAP NetWeaver and ABAP Platform allow an att…7.5
• CVE-2022-29617Due to improper error handling an authenticated user can cra…6.5
• CVE-2022-29618Due to insufficient input validation, SAP NetWeaver Developm…6.1
• CVE-2022-29619Under certain conditions SAP BusinessObjects Business Intell…6.5
• CVE-2022-2962A DMA reentrancy issue was found in the Tulip device emulati…7.8
• CVE-2022-29620FileZilla v3.59.0 allows attackers to obtain cleartext passw…6.5
• CVE-2022-29623An arbitrary file upload vulnerability in the file upload mo…7.8
• CVE-2022-29624An arbitrary file upload vulnerability in the Add File funct…8.8
• CVE-2022-29627An insecure direct object reference (IDOR) in Online Market …4.3
• CVE-2022-29628A cross-site scripting (XSS) vulnerability in /omps/seller o…5.4
• CVE-2022-2963A vulnerability found in jasper. This security vulnerability…7.5
• CVE-2022-29631Jodd HTTP v6.0.9 was discovered to contain multiple CLRF inj…7.5