CVE-2022-30999
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload.
- Record
CVE-2022-30999- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-3803
FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload.
- Record
EUVD-2022-3803- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fm53-mpmp-7qw2
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
Impact
If FoF Upload is configured to allow the uploading of SVG files (image/svg+xml), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker.
This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously.
Patches
This has been patched with v1.2.3, which now sanitizes uploaded SVG files.
Workarounds
Upgrade to 1.2.3 (requires Flarum 1.2 or later), or remove the ability for users to upload SVG files through FoF Upload.
References
Thank you to Safwat Refaat for the responsible disclosure of this vulnerability.
- Record
GHSA-fm53-mpmp-7qw2- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload.
- Record
CVE-2022-30999- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. This issue has been patched with v1.2.3, which now sanitizes uploaded SVG files. As a workaround, remove the ability for users to upload SVG files through FoF Upload.
- Record
CVE-2022-30999- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-fm53-mpmp-7qw2
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
Impact
If FoF Upload is configured to allow the uploading of SVG files (image/svg+xml), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker.
This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously.
Patches
This has been patched with v1.2.3, which now sanitizes uploaded SVG files.
Workarounds
Upgrade to 1.2.3 (requires Flarum 1.2 or later), or remove the ability for users to upload SVG files through FoF Upload.
References
Thank you to Safwat Refaat for the responsible disclosure of this vulnerability.
- Record
GHSA-fm53-mpmp-7qw2- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fof/uploadPackagist |
before 1.2.3 | 1.2.3 |
fof/uploadPackagist |
before 1.2.3, plus listed versions 0.1.00.1.10.1.20.1.30.10.0 Show 45 moreShow less0.10.10.110.11.10.11.20.11.30.12.00.12.10.12.100.12.20.12.30.12.40.12.50.12.60.12.70.12.80.12.90.13.00.13.10.14.00.14.0-beta0.14.0-beta.10.2.00.2.10.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.70.3.80.4.00.4.10.4.100.4.110.4.120.4.130.4.20.4.30.4.40.4.50.4.60.4.70.4.8 |
1.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-30999 is a high vulnerability (CVSS 8.7) in Friendsofflarum Upload, published May 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in fof/upload 1.2.3.
References
github.com/FriendsOfFlarum/upload/security/advisories/GHSA-fm53-mpmp-7qw2
nvd.nist.gov/vuln/detail/CVE-2022-30999
Left out here: 36 versions. The JSON record has them.