CVE-2021-47746

8.6 highEPSS 0.7%

High (8.6). EPSS 0.7% chance of exploitation in the next 30 days.

NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through the emoji upload API. Attackers with admin access can craft file upload requests with directory traversal to overwrite system files by manipulating the file path parameter.

Severity

CVSS 4.0

8.6 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-73
Published: 2026-01-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/NodeBB/nodebb-plugin-emoji
https://nodebb.org/
https://www.exploit-db.com/exploits/49813
https://www.vulncheck.com/advisories/nodebb-plugin-emoji-arbitrary-file-write

Check your stack JSON