Clarification on CVE-2022-29353 – Has This Been Addressed in Latest Versions?
Hi,

There are conflicting descriptions regarding CVE-2022-29353 across different sources.

The NVD entry ([CVE-2022-29353](https://nvd.nist.gov/vuln/detail/CVE-2022-29353)) states that an attacker can achieve remote code execution (RCE) via command injection in filenames.
Meanwhile, IBM X-Force ([IBM entry](https://xfe-development.xforce.ibm.com/vulnerabilities/226824)) suggests that RCE is possible by uploading malicious script files, which seems to depend on how developers handle file validation.

Given the lack of public details and contradictions between sources, could you clarify:

1. Has this CVE been acknowledged by the graphql-upload maintainers?
2. Was any security-related fix introduced in later versions (e.g., v16.x.x, v17.x.x)?

The available information does not make it clear whether this CVE is valid or a false positive. Any clarification would be helpful.