CVE-2022-24837

MEDIUM

HedgeDoc 1.9.1-<1.9.3 - Information Disclosure via Enumerable Uploaded Image Filenames

Title source: llm
STIX 2.1

Description

HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes and affects all upload backends, except Lutim and imgur. This issue is patched in version 1.9.3 by replacing the filename generation with UUIDv4. If you cannot upgrade to HedgeDoc 1.9.3, it is possible to block POST requests to `/uploadimage`, which will disable future uploads.

References (3)

Core 3
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/node-formidable/formidable/issues/808

Scores

CVSS v3 5.3
EPSS 0.0105
EPSS Percentile 59.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200 CWE-434
Status published
Products (1)
hedgedoc/hedgedoc 1.9.1 - 1.9.3
Published Apr 11, 2022
Tracked Since Feb 18, 2026