CVE-2021-26293

PoC —

CVSS 3.1

9.8 critical

EPSS

7%p94

Published

Mar 4, 2021 (Mar 4, 2021)

Modified

Jun 17, 2026

Description

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.

Vendors: afterlogic
Products: aurora, webmail pro
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (7.1%)

In the news0 stories

No ingested article mentions this CVE yet.