CVE-2021-26629

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is decompressed, an arbitrary file can be d in the parent path by using the path traversal pattern ‘..\’.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
tobesoft Co.,Ltd	XPLATFORM	>= unspecified, <= 9.2.2.280

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66674Third Party Advisory, VDB Entry
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66674Third Party Advisory, VDB Entry

Timeline

Published: Apr 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-266309.8Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vu CVE-2021-266317.5Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploi CVE-2021-266339.8SQL injection and Local File Inclusion (LFI) vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulner CVE-2021-266349.8SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files CVE-2021-266357.8In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wro CVE-2021-266369.6Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure a CVE-2021-266379.8There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so una CVE-2021-266389.8Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. Remo CVE-2021-266397.5This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can u CVE-2021-266429.8When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due CVE-2021-266449.8SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin board CVE-2021-266758.8A stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be used by network adjacent attackers to execute code.