External risk intelligence

Tiddlywiki5 Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-29351

TiddlyWiki5 is a personal non-linear notebook often used as a standalone HTML file or local application. While it can be hosted on web servers, it is not inherently designed as a public-facing edge service, gateway, or identity portal. Internet exposure is possible depending on how a user chooses to deploy their instance, but it is not a default or common pattern for this type of software.

Unrestricted File Upload

Tiddlywiki5

5.2.2

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified that could allow attackers to execute arbitrary code through a specially crafted file uploaded to Tiddlywiki5. While the vendor disputes the existence of a vulnerability, the potential for code execution warrants attention to confirm if your deployed instances are affected and if the exposure aligns with your security posture.

Upload flaw could allow code execution.
Vendor disputes vulnerability. Confirm relevance.
Understand potential exposure and risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by uploading a specially crafted SVG file through the application's file upload feature. This could potentially lead to the execution of arbitrary code on the server, depending on how the application processes and renders uploaded files. The vendor disputes the existence of a vulnerability.

Requires anonymous, unauthenticated access.
Triggered by uploading a malicious SVG file.
Risk: Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

The file upload module in Tiddlywiki5, when potentially exposed to the network, could allow an attacker to upload a crafted SVG file. This could lead to the execution of arbitrary code, impacting the integrity and availability of the affected instance.

System data could be compromised.
Code execution via crafted SVG upload.
Unauthorized control over the Tiddlywiki instance.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that TiddlyWiki is typically a personal tool, the primary responsibility for managing this would likely fall on the individual user or the application owner if it's integrated into a broader system. The first practical step is to identify any instances of TiddlyWiki, determine if they are exposed to the internet or hold critical data, and then ascertain the accountable owner before planning any remediation.

Individual users or application owners
Confirm internet exposure and data criticality
Educate users or plan targeted remediation

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is TiddlyWiki5?

TiddlyWiki5 is a flexible, non-linear personal notebook software. Users typically run it as a standalone HTML file or a local application to manage information, organize tasks, and store data. Because it is highly customizable, some users may deploy it on web servers to share content or collaborate, though it is not primarily built as a public-facing infrastructure service.

What does CWE-434 mean regarding CVE-2022-29351?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In the context of CVE-2022-29351, this means the software's file upload module may accept files without sufficient validation. This flaw potentially allows an attacker to upload a crafted SVG file that the application processes in a way that executes unintended, arbitrary code.

How is this TiddlyWiki5 vulnerability triggered?

The issue is triggered when an attacker successfully uploads a specially crafted SVG file through the application's file upload feature. It does not occur through standard, legitimate interactions with the notebook. If the application configuration does not allow file uploads or if the upload module is disabled, this specific execution path is not viable.

Who should be concerned about this vulnerability?

You should care if you host TiddlyWiki5 on a server accessible to the internet. According to Halo Surface Signal, this software is often used locally, meaning internet exposure is not a default pattern. If your instance is strictly local or password-protected, the threat level is significantly lower than for an instance exposed to the open web.

What should I do if I use TiddlyWiki5?

Start by identifying where TiddlyWiki5 is deployed within your environment. Determine if your specific instance is reachable from the internet or if it stores sensitive data. Since the vendor disputes this as a vulnerability, confirm your own security requirements for file uploads and evaluate whether restricting access or updating the software aligns with your operational needs.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.