CVE-2021-41566 Tad TadTools - Arbitrary File Upload

Critical 9.8 Published 8 Oct 2021 Updated 17 Sep 2024

Remote attackers can upload arbitrary files and execute code without authentication due to missing file extension filtering in TadTools.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-41566?

CVE-2021-41566 is a critical vulnerability in TadTools, published on 8 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.

Weakness: CWE-434

Which versions are affected by CVE-2021-41566?

It affects 1 product.

Products include Tadtools Project Tadtools.

How do I fix CVE-2021-41566?

No fix has been published for CVE-2021-41566 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-41566 being exploited?

There is no known exploitation of CVE-2021-41566 in the wild and no public exploit code.

Sources

Also known as GHSA-ccv5-px65-27x6.