CVE-2021-47978

6.9 mediumEPSS 0.8%

Medium (6.9). EPSS 0.8% chance of exploitation in the next 30 days.

ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without authentication.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.2 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-98
Published: 2026-05-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.exploit-db.com/exploits/50229
https://www.processmaker.com/
https://www.vulncheck.com/advisories/processmaker-local-file-inclusion-via-path-traversal

Check your stack JSON