CVE-2021-21245

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
theonedev	onedev	< 4.0.3

References

https://github.com/theonedev/onedev/commit/0c060153fb97c0288a1917efdb17cc426934dacbPatch, Third Party Advisory
https://github.com/theonedev/onedev/security/advisories/GHSA-62m2-38q5-96w9Third Party Advisory
https://github.com/theonedev/onedev/commit/0c060153fb97c0288a1917efdb17cc426934dacbPatch, Third Party Advisory
https://github.com/theonedev/onedev/security/advisories/GHSA-62m2-38q5-96w9Third Party Advisory

Timeline

Published: Jan 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-212467.5OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make su CVE-2021-212478.8OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`Abstr CVE-2021-212488.8OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint para CVE-2021-212498.8OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-aut CVE-2021-21254.6Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prio CVE-2021-212506.5OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file CVE-2021-212518.8OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical "zip slip" vulnerability. This issue may lead to CVE-2021-212527.5The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jqu CVE-2021-212535.3OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt,CVE-2021-212546.5CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-mar CVE-2021-212555.7GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software aud CVE-2021-212577.5Contiki-NG is an open-source, cross-platform operating system for internet of things devices. The RPL-Classic and RPL-Lite implementations i