CVE-2021-23803

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	latte/latte	>= unspecified, < 2.10.6

References

https://github.com/nette/latte/commit/227c86eda9a8a6d060ea8501923e768b6d992210Patch, Third Party Advisory
https://github.com/nette/latte/issues/279Exploit, Issue Tracking, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-PHP-LATTELATTE-1932226Exploit, Patch, Third Party Advisory
https://github.com/nette/latte/commit/227c86eda9a8a6d060ea8501923e768b6d992210Patch, Third Party Advisory
https://github.com/nette/latte/issues/279Exploit, Issue Tracking, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-PHP-LATTELATTE-1932226Exploit, Patch, Third Party Advisory

Timeline

Published: Dec 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-238079.8This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix CVE-2021-23813.9Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily expl CVE-2021-238148.8This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the fil CVE-2021-23829.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Security). Supported versions that are affected CVE-2021-238209.8This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer com CVE-2021-238246.1This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to in CVE-2021-238275.5Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive medi CVE-2021-23834.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 an CVE-2021-238354.9An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docs_file HTTP reque CVE-2021-238364.8An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request bod CVE-2021-238376.5An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selected_folder HTTP requ CVE-2021-238384.8An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_filter HTTP request bo