CVE-2021-23258

7.2 highEPSS 0.7%

High (7.2) in craftercms crafter cms. EPSS 0.7% chance of exploitation in the next 30 days.

Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-913
Published: 2021-12-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

craftercms:crafter_cms

References

https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120101
https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120101

Check your stack JSON