1. Home
  2. CVE Database
  3. CVE-2021-26293
CRITICAL · 9.8

CVE-2021-26293

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the ...

Vulnerability Description

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
AfterlogicAurora<= 8.5.3
AfterlogicWebmail Pro<= 8.5.3

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2021-26293?

CVE-2021-26293 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the ...

How severe is CVE-2021-26293?

CVE-2021-26293 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2021-26293?

Check the references section above for vendor advisories and patch information. Affected products include: Afterlogic Aurora, Afterlogic Webmail Pro.