CVE-2021-23772

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published
Dec 24, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-23787.5Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2021-237846.1This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without beinCVE-2021-237929.8The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecureCVE-2021-237979.8All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is.CVE-2021-23807.6Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Supported versCVE-2021-238039.8This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the applicationCVE-2021-238079.8This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fixCVE-2021-23813.9Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily explCVE-2021-238148.8This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the filCVE-2021-23829.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security). Supported versions that are affected CVE-2021-238209.8This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer comCVE-2021-238246.1This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to in
CVE-2021-23772: High severity, CVSS 8.8 | Vulnix