{"cve":"CVE-2021-23827","nvd":{"published":"2021-02-23T00:15:12.533","modified":"2026-06-17T03:38:53.850","status":"Modified","description":"Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive media (such as private pictures) in the Cache and uploadtemps directories. It fails to effectively clear cached pictures, even after deletion via normal methodology within the client, or by utilizing the \"Explode message/Explode now\" functionality. Local filesystem access is needed by the attacker.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5},"cwes":["CWE-312"],"references":["https://github.com/keybase/client/releases","https://hackerone.com/reports/1074930","https://johnjhacking.com/blog/cve-2021-23827/","https://github.com/keybase/client/releases","https://hackerone.com/reports/1074930"],"products":["keybase:keybase"],"source":"nvd","synced_at":"2026-10-19T21:15:50.279857260+00:00"},"epss":{"cve":"CVE-2021-23827","score":0.00296,"percentile":0.22254,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}