Packagist/xpressengine/xpressengine CVE-2021-26642: critical 9.8, EPSS 1.21%
XpressEngine vulnerable to Unrestricted Upload of File with Dangerous Type
Action: Upgrade xpressengine/xpressengine to 3.0.15 or later.
composer require xpressengine/xpressengine:3.0.15Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.0.15 | - |
Fixed versions
| 3.0.15 |
Sources
- osv: GHSA-8r5j-22j5-w4cm
- https://nvd.nist.gov/vuln/detail/CVE-2021-26642
- https://github.com/xpressengine/xpressengine/issues/1366
- https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=67125
CVE-2021-26642 · published · modified · JSON