CVE-2021-41595

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name parameter of the Step3 import functionality.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_33Release Notes, Vendor Advisory
https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_22Release Notes, Vendor Advisory
https://github.com/ach-ing/cves/blob/main/CVE-2021-41595.mdThird Party Advisory
https://github.com/salesagility/SuiteCRMProduct, Third Party Advisory
https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_33Release Notes, Vendor Advisory
https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_22Release Notes, Vendor Advisory
https://github.com/ach-ing/cves/blob/main/CVE-2021-41595.mdThird Party Advisory
https://github.com/salesagility/SuiteCRMProduct, Third Party Advisory

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-415965.3SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files CVE-2021-415978.8SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is CVE-2021-415988.8A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub CVE-2021-415998.8A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. CVE-2021-41605.9There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 CVE-2021-416087.5A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthentica CVE-2021-416099.8SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenti CVE-2021-41617.5The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. CVE-2021-416117.5An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly CVE-2021-416128.8An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract ins CVE-2021-416134.3An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The write logic of Exception Effective Address Register (EE CVE-2021-416147.8An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program