CVE-2021-42556

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Rasa X before 0.42.4 allows Directory Traversal during archive extraction. In the functionality that allows a user to load a trained model archive, an attacker has arbitrary write capability within specific directories via a crafted archive file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/RasaHQ/rasa-x-security-advisories/security/advisories/GHSA-vp2h-j6px-56rcThird Party Advisory
https://rasa.comProduct
https://github.com/RasaHQ/rasa-x-security-advisories/security/advisories/GHSA-vp2h-j6px-56rcThird Party Advisory
https://rasa.comProduct

Timeline

Published: Oct 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-425577.5In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials.CVE-2021-425586.1An issue was discovered in CALDERA 2.8.1. It contains multiple reflected, stored, and self XSS vulnerabilities that may be exploited by auth CVE-2021-425598.8An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Becaus CVE-2021-42566.1A vulnerability was found in ctrlo lenio. It has been classified as problematic. This affects an unknown part of the file views/index.tt. Th CVE-2021-425608.8An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These CVE-2021-425618.8An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" fun CVE-2021-425628.1An issue was discovered in CALDERA 2.8.1. It does not properly segregate user privileges, resulting in non-admin users having access to read CVE-2021-425637.8There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows. This may allow an authorized lo CVE-2021-425645.4An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to prov CVE-2021-425656.1myfactory.FMS before 7.1-912 allows XSS via the UID parameter.CVE-2021-425666.1myfactory.FMS before 7.1-912 allows XSS via the Error parameter.CVE-2021-425676.1Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.