CVE-2021-40870 Aviatrix Controller Unrestricted Upload of File

Exploited in the wild Critical 9.8 Published 13 Sep 2021 Updated 21 Oct 2025

Unauthenticated attackers can upload malicious files to execute arbitrary code on the Aviatrix Controller via directory traversal.

Exploited in the wild: Since 18 Jan 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-40870?

CVE-2021-40870 is a critical vulnerability in n/a, published on 13 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.

Weakness: CWE-23

Which versions are affected by CVE-2021-40870?

It affects 1 product.

Products include Aviatrix Controller.

How do I fix CVE-2021-40870?

No fix has been published for CVE-2021-40870 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 1 Feb 2022.

Is CVE-2021-40870 being exploited?

Yes. Attackers have exploited CVE-2021-40870 in the wild since at least 18 Jan 2022.

Public exploit code: 1 Nuclei template and 4 proofs of concept on GitHub.

Sources

Also known as GHSA-w7mg-q4hh-m9cq.