CVE-2021-26618

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitrary file included malicious code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Feb 18, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-266199.1An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerabilitCVE-2021-266207.5An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steaCVE-2021-266219.8An Buffer Overflow vulnerability leading to remote code execution was discovered in MEX01. Remote attackers can use this vulnerability by usCVE-2021-2662210.0An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NACVE-2021-266239.8A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark CVE-2021-266248.8An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid argumentsCVE-2021-266258.8Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerabilitCVE-2021-266268.8Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter valuCVE-2021-266277.5Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to remCVE-2021-266286.1Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading fileCVE-2021-266298.8A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file isCVE-2021-266309.8Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vu
CVE-2021-26618: Critical severity, CVSS 9.8 | Vulnix