CVE-2021-47899 YetiShare File Hosting Script 5.1.0 Remote File Upload SSRF Vulnerability
Attackers can exploit a Server-Side Request Forgery vulnerability in the remote file upload feature to read sensitive local system files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47899?
CVE-2021-47899 is a medium-severity server-side request forgery vulnerability in Mfscripts YetiShare File Hosting Script, published on 23 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read local system files through the remote file upload feature. Attackers can exploit the url parameter in the url_upload_handler endpoint to access sensitive files like /etc/passwd by using file:/// protocol.
Weakness: CWE-434
Which versions are affected by CVE-2021-47899?
How do I fix CVE-2021-47899?
No fix has been published for CVE-2021-47899 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-47899 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47899 exists.
Sources
Also known as GHSA-38wv-wfx6-3cx2.