CVEvulnerability
CVE-2021-47746
8.6 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-01-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-73
Description
NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through the emoji upload API. Attackers with admin access can craft file upload requests with directory traversal to overwrite system files by manipulating the file path parameter.
Related
Weakness · CWE (1)
- CWE-73 External Control of File Name or Path weakness
References
- https://github.com/NodeBB/nodebb-plugin-emoji github.com
- https://nodebb.org/ nodebb.org
- https://www.exploit-db.com/exploits/49813 www.exploit-db.com
- https://www.vulncheck.com/advisories/nodebb-plugin-emoji-arbitrary-file-write www.vulncheck.com