CVE-2022-29622

Deeper analysis

CVE-2022-29622 is an arbitrary file upload vulnerability in the formidable library version 3.1.4 that permits attackers to execute arbitrary code through a crafted filename. The issue stems from insufficient validation of uploaded file names, falling under CWE-434, and carries a CVSS 3.1 score of 9.8. Formidable is a widely used Node.js package for parsing multipart form data, including file uploads, and the flaw was reported in the context of applications such as Strapi that integrate the library.

Unauthenticated remote attackers can exploit the vulnerability over the network by submitting a maliciously named file during a file upload operation, resulting in full compromise of confidentiality, integrity, and availability on the affected server. Because the attack requires no user interaction or credentials, it can be launched against any exposed endpoint that processes uploads through the vulnerable version.

References in the GitHub issues for formidable and Strapi, along with related technical discussions, note that the library provides configuration options to alter default file-handling behavior and that some use cases intentionally allow arbitrary file uploads. Strapi explicitly states it does not regard the reported behavior as a valid vulnerability in its own product.

The EPSS score for this CVE rose from lower values after disclosure to a peak of 0.3440 on 2025-12-18 before receding to the current 0.2446, indicating a period of increased exploitation interest that later subsided.