Wiz
Vulnerability DatabaseCVE-2022-28919

CVE-2022-28919: 
NixOS vulnerability analysis and mitigation

Overview

HTMLCreator release_stable_2020-07-29 was discovered to contain a cross-site scripting (XSS) vulnerability via the function _generateFilename. The vulnerability was identified in March 2022 and affects DokuWiki and the php-openpsa-universalfeedcreator package (GitHub Issue, Debian Tracker).

Technical details

The vulnerability exists in the _generateFilename function within the HTMLCreator component, specifically in the file vendor/openpsa/universalfeedcreator/lib/Creator/HTMLCreator.php at line 157. The vulnerability is triggered through the pathinfo function in PHP, which can be bypassed to execute cross-site scripting attacks. The issue is connected to the feed.php file at line 103 (GitHub Issue).

Impact

This vulnerability allows for cross-site scripting (XSS) attacks, which could potentially enable attackers to inject malicious client-side scripts into web pages viewed by other users (Debian Tracker).

Mitigation and workarounds

The vulnerability has been fixed in version 1.8.4.1 of php-openpsa-universalfeedcreator. Various Linux distributions have released security updates to address this issue, including Fedora 34, 35, and 36 (Fedora Update).

Additional resources

Source: This report was generated using AI

Related NixOS vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-22783HIGH8.1
  • NixOSNixOS
  • iris
NoYesJan 12, 2026
CVE-2026-0821MEDIUM6.9
  • NixOSNixOS
  • quickjs
NoNoJan 10, 2026
CVE-2025-68949MEDIUM5.3
  • NixOSNixOS
  • n8n
NoYesJan 13, 2026
CVE-2026-22784LOW2.3
  • NixOSNixOS
  • lychee
NoYesJan 12, 2026
CVE-2026-23497LOW1.3
  • NixOSNixOS
  • learning
NoYesJan 14, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo