CVE-2021-26610

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-353 CWE-345

Affected software

Vendor	Product	Versions
NHN COMMERCE	godomall5 Std, godomall5 Pro	>= 6, <= 6; >= 9, <= 9

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36304Third Party Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36304Third Party Advisory

Timeline

Published: Oct 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-266119.8HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(r CVE-2021-266129.8An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy CVE-2021-266137.5improper input validation vulnerability in nexacro permits copying file to the startup folder using rename method.CVE-2021-266149.8ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable we CVE-2021-266158.8ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an int CVE-2021-266169.8An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.CVE-2021-266179.8This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to exe CVE-2021-266189.8An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerabilit CVE-2021-266199.1An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerabilit CVE-2021-266207.5An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to stea CVE-2021-266219.8An Buffer Overflow vulnerability leading to remote code execution was discovered in MEX01. Remote attackers can use this vulnerability by us CVE-2021-2662210.0An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NA