CVE-2021-29246

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin file with special characters to upload the file outside of the restricted directory.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.btcpayserver.org/vulnerability-disclosure-v1-0-7-0/Vendor Advisory
https://github.com/btcpayserver/btcpayserver/releasesRelease Notes, Third Party Advisory
https://blog.btcpayserver.org/vulnerability-disclosure-v1-0-7-0/Vendor Advisory
https://github.com/btcpayserver/btcpayserver/releasesRelease Notes, Third Party Advisory

Timeline

Published: May 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-292475.3BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for CVE-2021-292485.3BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a CVE-2021-292497.5BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability.CVE-2021-292505.4BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products functionality. This CVE-2021-292516.5BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies). This affects Docker CVE-2021-292525.4RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability. A remote authenticated malicious Archer user with access to modi CVE-2021-292535.5The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability.CVE-2021-292557.5MicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin credentials in cleartext to pnp.microseven.com TCP port 7007. An attacker on CVE-2021-292568.8. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root pr CVE-2021-292587.5An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a CVE-2021-292617.8The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace con CVE-2021-292627.5When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no