Detections
Analytics
SCA: security update for fof/upload (GHSA-fm53-mpmp-7qw2)
medium Tenable Self-Hosted Container Security Plugin ID 414576
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If
FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'),
navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker.
This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service.
This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified
maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a
workaround, remove the ability for users to upload SVG files through FoF Upload. (CVE-2022-30999)
See Also
Plugin Details
Severity: Medium
ID: 414576
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 8.67
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Low
Base Score: 3.5
Temporal Score: 2.7
Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS Score Source: CVE-2022-30999
CVSS v3
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/25/2022
Vulnerability Publication Date: 5/25/2022
Reference Information
CVE: CVE-2022-30999
cwe: CWE-79