CVE-2021-42342

—

CVSS 3.1

9.8 critical

EPSS

59%p99

Published

Oct 14, 2021 (Oct 14, 2021)

Modified

Jun 17, 2026

Description

An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. This permits tunneling untrusted environment variables into vulnerable CGI scripts.

Vendors: embedthis
Products: goahead
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (59.5%)

In the news0 stories

No ingested article mentions this CVE yet.