CVE-2021-42342

9.8 criticalEPSS 59%

Critical (9.8) in embedthis goahead. EPSS 59% chance of exploitation in the next 30 days.

An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. This permits tunneling untrusted environment variables into vulnerable CGI scripts.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 59% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2021-10-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

embedthis:goahead

References

https://github.com/embedthis/goahead/issues/305
https://github.com/embedthis/goahead/issues/305

Check your stack JSON