CVE-2021-45790

9.8 criticalEPSS 1.9%

Critical (9.8) in metersphere metersphere. EPSS 1.9% chance of exploitation in the next 30 days.

An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to arbitrary directory, where attackers can write a cron job to execute commands.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2022-09-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

metersphere:metersphere

References

https://github.com/metersphere/metersphere/issues/8653
https://github.com/metersphere/metersphere/issues/8653

Check your stack JSON