CVE-2021-29246: Path Traversal
BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin file with special characters to upload the file outside of the restricted directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29246?
CVE-2021-29246 is considered a critical security vulnerability due to its potential for code execution by an attacker with admin privileges.
How do I fix CVE-2021-29246?
To fix CVE-2021-29246, upgrade your BTCPay Server installation to a version prior to 1.0.8.0 that addresses this vulnerability.
Who is affected by CVE-2021-29246?
CVE-2021-29246 affects all versions of BTCPay Server up to and including 1.0.7.0.
What can an attacker do with CVE-2021-29246?
An attacker with admin privileges can exploit CVE-2021-29246 to execute arbitrary code by crafting a malicious plugin file.
Is user intervention required to exploit CVE-2021-29246?
Yes, an attacker must have admin privileges and must intentionally upload a specially crafted plugin file to exploit CVE-2021-29246.