Every CVE Search/ Get API key

CVE-2022-29622

Formidable arbitrary file upload

9.8 CriticalPublic exploitFix availableDisputed

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.37%Up 0.8 points since May 17, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.

Record
CVE-2022-29622
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-434
Updated
2026-11-02
CVE List No score

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.

Record
CVE-2022-29622
Updated
2026-11-02
EUVDEUVD-2022-3164 No score

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.

Record
EUVD-2022-3164
Updated
2026-11-03
GitHub AdvisoriesGHSA-8cp3-66vr-3r4c 9.8

Formidable arbitrary file upload

Withdrawn: This advisory was improperly assigned.

An arbitrary file upload vulnerability in formidable v3.2.4 allows attackers to execute arbitrary code via a crafted filename.

Record
GHSA-8cp3-66vr-3r4c
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Updated
2026-11-02
OSVDEBIAN-CVE-2022-29622 9.8

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.

Record
DEBIAN-CVE-2022-29622
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVGHSA-8cp3-66vr-3r4c 9.8

Formidable arbitrary file upload

Withdrawn: This advisory was improperly assigned.

An arbitrary file upload vulnerability in formidable v3.2.4 allows attackers to execute arbitrary code via a crafted filename.

Record
GHSA-8cp3-66vr-3r4c
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Updated
2026-11-02
OSV No score

An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.

Record
CVE-2022-29622
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2022-29622 No score

CVE-2022-29622 in formidable - Patched by Root

Root has patched CVE-2022-29622 in the formidable package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2022-29622
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
node-formidable
Debian:12
 before 3.2.4+20220519git81dd350+~cs4.0.9-1
3.2.4+20220519git81dd350+~cs4.0.9-1
node-formidable
Debian:13
 before 3.2.4+20220519git81dd350+~cs4.0.9-1
3.2.4+20220519git81dd350+~cs4.0.9-1
node-formidable
Debian:14
 before 3.2.4+20220519git81dd350+~cs4.0.9-1
3.2.4+20220519git81dd350+~cs4.0.9-1
formidable
Root:npm
 before 2.1.2-aikido.3
2.1.2-aikido.31.2.6-aikido.1
@rootio/formidable
Root:npm
 before 2.1.2-root.io.3
2.1.2-root.io.31.2.6-root.io.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubkeymandll/CVE-2022-296222022-06-05

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-29622 is a critical vulnerability (CVSS 9.8) in Formidable Project Formidable, published May 16, 2022. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.37%, the 88th percentile. Fixed in node-formidable 3.2.4+20220519git81dd350+~cs4.0.9-1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open