CVE-2022-30999

FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload.

• CWE-79

• https://github.com/FriendsOfFlarum/upload/issues/68Exploit, Issue Tracking, Third Party Advisory
• https://github.com/FriendsOfFlarum/upload/pull/318Patch, Third Party Advisory
• https://github.com/FriendsOfFlarum/upload/releases/tag/1.2.3Patch, Third Party Advisory
• https://github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2Third Party Advisory
• https://github.com/FriendsOfFlarum/upload/issues/68Exploit, Issue Tracking, Third Party Advisory
• https://github.com/FriendsOfFlarum/upload/pull/318Patch, Third Party Advisory
• https://github.com/FriendsOfFlarum/upload/releases/tag/1.2.3Patch, Third Party Advisory
• https://github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2Third Party Advisory

Published

Jun 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30993Cleartext transmission of sensitive information. The followi…7.5
• CVE-2022-30994Cleartext transmission of sensitive information. The followi…7.5
• CVE-2022-30995Sensitive information disclosure due to improper authenticat…7.5
• CVE-2022-30996Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-30997Use of hard-coded credentials vulnerability exists in STARDO…7.2
• CVE-2022-30998Multiple Authenticated (subscriber or higher user role) SQL …8.8
• CVE-2022-3100A flaw was found in the openstack-barbican component. This i…5.9
• CVE-2022-31000solidus_backend is the admin interface for the Solidus e-com…4.3
• CVE-2022-31001Sofia-SIP is an open-source Session Initiation Protocol (SIP…7.5
• CVE-2022-31002Sofia-SIP is an open-source Session Initiation Protocol (SIP…7.5
• CVE-2022-31003Sofia-SIP is an open-source Session Initiation Protocol (SIP…9.8
• CVE-2022-31004CVEProject/cve-services is an open source project used to op…7.5