CVE-2021-38572

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-385739.8An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname i CVE-2021-385749.8An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows SQL Injection via crafted data at the end of a string.CVE-2021-385758.1NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.CVE-2021-385767.5A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TP CVE-2021-385789.8Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.CVE-2021-38588.8snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-385836.1openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting (XSS) on multiple pag CVE-2021-385847.2The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).CVE-2021-385857.2The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).CVE-2021-385864.4In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).CVE-2021-385877.5In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586).CVE-2021-385888.1In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).