CVE-2022-29351

CriticalCVSS 9.8

Published: 16/05/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.36%

82th percentile - higher than 82% of all known CVEs

Summary

An arbitrary file upload vulnerability in Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.

Risk Assessment

The risk for the organization is remote code execution, potentially leading to server compromise or data theft.

Recommendation

Immediately update Tiddlywiki5 to the latest version and implement file type validation in the upload module to block dangerous formats.

Original NVD description (English source)

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file. Note: The vendor argues that this is not a legitimate issue and there is no vulnerability here.