CVE-2021-24035

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-23CWE-22

Affected software

VendorProductVersions
FacebookWhatsApp Business for Android>= unspecified, < v2.21.8.13
FacebookWhatsApp for Android>= unspecified, < v2.21.8.13

References

Timeline

Published
Jun 11, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-240369.8Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with CVE-2021-240379.8A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackersCVE-2021-240387.8Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged pCVE-2021-24046.5Vulnerability in the PeopleSoft Enterprise HCM Candidate Gateway product of Oracle PeopleSoft (component: e-mail notification). The supporteCVE-2021-240409.8Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicioCVE-2021-240419.8A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could haCVE-2021-240429.8The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.CVE-2021-240439.1A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsAppCVE-2021-240449.8By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would CVE-2021-240459.8A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that CVE-2021-240465.3A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the FaceboCVE-2021-24058.1Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affec
CVE-2021-24035: Critical severity, CVSS 9.1 | Vulnix