CVE-2022-29622: Formidable arbitrary file upload

The core vulnerability stems from filename handling in Formidable's parsing logic. The GitHub PR #857 specifically modifies _getExtension to address extension validation, replacing a problematic regex with character-by-character validation. The _getFileName function's handling of quoted filenames and HTML entity decoding (shown in issue #862's test case) could allow crafted filenames to bypass security checks. While the vulnerability is disputed due to Formidable's intended low-level nature, these functions represent the technical root of the alleged vulnerability when used with default/unsafe configurations.