CVSS 3.1
5.0 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NCVE-2021-43788
Medium (5.0) in nodebb nodebb. EPSS 26% chance of exploitation in the next 30 days. Fixed in nodebb 1.18.5.
Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
Severity
- EPSS
- 26% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- nodebb:nodebb
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pfj7-2qfw-vwgm | npm | nodebb | >=1.0.4 <1.18.5 | 1.18.5 |
References
- https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/
- https://github.com/NodeBB/NodeBB/commit/c8b2fc46dc698db687379106b3f01c71b80f495f
- https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5
- https://github.com/NodeBB/NodeBB/security/advisories/GHSA-pfj7-2qfw-vwgm
- https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/