CVE-2021-29281

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which is affected by CVE-2014-2217, and CVE-2017-11317.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://aminbohio.com/gfi-mail-archiver-15-1-telerik-ui-component-arbitrary-file-upload-unauthenticated-exploit/Exploit, Third Party Advisory
https://cwe.mitre.org/data/definitions/434.htmlTechnical Description, Third Party Advisory
https://owasp.org/www-community/vulnerabilities/Unrestricted_File_UploadTechnical Description, Third Party Advisory
https://www.exploit-db.com/exploits/50181Exploit, Third Party Advisory, VDB Entry
https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-archiverProduct
https://aminbohio.com/gfi-mail-archiver-15-1-telerik-ui-component-arbitrary-file-upload-unauthenticated-exploit/Exploit, Third Party Advisory
https://cwe.mitre.org/data/definitions/434.htmlTechnical Description, Third Party Advisory
https://owasp.org/www-community/vulnerabilities/Unrestricted_File_UploadTechnical Description, Third Party Advisory
https://www.exploit-db.com/exploits/50181Exploit, Third Party Advisory, VDB Entry
https://www.gfi.com/products-and-solutions/network-security-solutions/gfi-archiverProduct

Timeline

Published: Jul 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-292947.5Null Pointer Dereference vulnerability exists in D-Link DSL-2740R UK_1.01, which could let a remove malicious user cause a denial of service CVE-2021-292957.5Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via CVE-2021-292967.5Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vul CVE-2021-292975.3Buffer Overflow in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash CVE-2021-292985.3Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and applicat CVE-2021-293009.8The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute c CVE-2021-293028.1TP-Link TL-WR802N(US), Archer_C50v5_US v4_200 <= 2020.06 contains a buffer overflow vulnerability in the httpd process in the body message. CVE-2021-293136.1Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v_company and (2) v_tvs parameters in /admin_video.php,CVE-2021-293235.5OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow via the component /modules/network/wifi/esp/modwifi.c.CVE-2021-293247.8OpenSource Moddable v10.5.0 was discovered to contain a stack overflow via the component /moddable/xs/sources/xsScript.c.CVE-2021-293257.8OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fx_String_prototype_repeat function at /moddable/xs/sour CVE-2021-293267.8OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fxIDToString function at /moddable/xs/sources/xsSymbol.c