NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
HIGH severity

Possible cross-site scripting attack via unsanitized SVG files in FoF UploadGHSA-fm53-mpmp-7qw2

HIGHFix: FriendsOfFlarum/upload#318

GHSA-fm53-mpmp-7qw2 is a high-severity (CVSS 8.7) Cross-site Scripting (XSS) vulnerability in fof/upload. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for fof/upload — see the affected versions and patch details below.

Also known asCVE-2022-30999
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
1 known
Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for GHSA-fm53-mpmp-7qw2.

EPSS Exploitation Probability

via FIRST.org ↗
1.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs70th percentile — riskier than 70% of all scored CVEsHighest risk
0.00%0.59%1.18%1.76%0.3%1.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐘fof/upload

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

If FoF Upload is configured to allow the uploading of SVG files (image/svg+xml), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker.

This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously.

Patches

This has been patched with v1.2.3, which now sanitizes uploaded SVG files.

Workarounds

Upgrade to 1.2.3 (requires Flarum 1.2 or later), or remove the ability for users to upload SVG files through FoF Upload.

References

Thank you to Safwat Refaat for the responsible disclosure of this vulnerability.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistfof/uploadall versions1.2.3composer require fof/upload:^1.2.3

Affected Products

1 product · 1 configurations
Application
uploadfriendsofflarum
< 1.2.3
range
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

FriendsofFlarum (FoF) Upload is an extension that handles file uploads i…

github.comNVDJun 2022

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fof/upload, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update fof/upload to 1.2.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-fm53-mpmp-7qw2 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Impact If FoF Upload is configured to allow the uploading of SVG files (`image/svg+xml`), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker. This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously. ### Patches This has been patched with v1.2.3, which now sanitizes uploaded SVG files. ### Workarounds Upgrade to `1.2.3` (requires Flarum 1.2 or later), or remove the abilit
O3 Security · Impact-Aware SCA

Is GHSA-fm53-mpmp-7qw2 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Possible cross-site scripting attack via unsanitized SVG…