CVE-2021-41185

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has been applied and a release made. Users should upgrade to version 8.12.7. As a workaround, users may manually apply the changes from the fix commit.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
kizniche	Mycodo	< 8.12.7

References

https://github.com/kizniche/Mycodo/commit/23ac5dd422029c2b6ae1701a3599b6d41b66a6a9Patch, Third Party Advisory
https://github.com/kizniche/Mycodo/issues/1105Issue Tracking, Third Party Advisory
https://github.com/kizniche/Mycodo/releases/tag/v8.12.7Release Notes, Third Party Advisory
https://github.com/kizniche/Mycodo/security/advisories/GHSA-252r-94ph-m229Patch, Third Party Advisory
https://github.com/kizniche/Mycodo/commit/23ac5dd422029c2b6ae1701a3599b6d41b66a6a9Patch, Third Party Advisory
https://github.com/kizniche/Mycodo/issues/1105Issue Tracking, Third Party Advisory
https://github.com/kizniche/Mycodo/releases/tag/v8.12.7Release Notes, Third Party Advisory
https://github.com/kizniche/Mycodo/security/advisories/GHSA-252r-94ph-m229Patch, Third Party Advisory

Timeline

Published: Oct 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411867.5Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin i CVE-2021-411878.8DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerabilit CVE-2021-411885.4Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in CVE-2021-411897.2DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permis CVE-2021-41199.8bookstack is vulnerable to Improper Access Control CVE-2021-411905.0The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution CVE-2021-411917.5Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have s CVE-2021-411926.5Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying t CVE-2021-411939.8wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions p CVE-2021-411949.8FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When Jupyter CVE-2021-411955.5TensorFlow is an open source platform for machine learning. In affected versions the implementation of `tf.math.segment_*` operations result CVE-2021-411965.5TensorFlow is an open source platform for machine learning. In affected versions the Keras pooling layers can trigger a segfault if the size