CVE-2021-39500: Path Traversal
First published: Tue Sep 07 2021(Updated: )
Eyoucms 1.5.4 is vulnerable to Directory Traversal. Due to a lack of input data sanitizaton in param tpldir, filename, type, nid an attacker can inject "../" to escape and write file to writeable directories.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eyoucms Eyoucms | =1.5.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-39500?
CVE-2021-39500 is a vulnerability in Eyoucms 1.5.4 that allows directory traversal, allowing an attacker to escape and write files to writable directories.
How severe is CVE-2021-39500?
CVE-2021-39500 has a severity rating of 7.5 (high).
What is the affected software version?
Eyoucms 1.5.4 is the affected version.
How can an attacker exploit CVE-2021-39500?
An attacker can exploit CVE-2021-39500 by injecting "../" in parameters tpldir, filename, type, or nid to perform directory traversal and write files to writable directories.
Is there a fix available for CVE-2021-39500?
Yes, a fix for CVE-2021-39500 is available in Eyoucms version 1.5.5 or later.
- collector/nvd-index
- vendor/eyoucms
- canonical/eyoucms eyoucms
- version/eyoucms eyoucms/1.5.4