CVE-2021-26623

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library. Remote attackers can induce exploit malicious code using this function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Apr 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-266248.8An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid arguments CVE-2021-266258.8Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerabilit CVE-2021-266268.8Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter valu CVE-2021-266277.5Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to rem CVE-2021-266286.1Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file CVE-2021-266298.8A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is CVE-2021-266309.8Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vu CVE-2021-266317.5Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploi CVE-2021-266339.8SQL injection and Local File Inclusion (LFI) vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulner CVE-2021-266349.8SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files CVE-2021-266357.8In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wro CVE-2021-266369.6Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure a