CVE-2021-21014

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

• CWE-434

• https://helpx.adobe.com/security/products/magento/apsb21-08.htmlVendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb21-08.htmlVendor Advisory

Published

Feb 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21009Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.…8.6
• CVE-2021-2101Vulnerability in the Oracle One-to-One Fulfillment product o…9.1
• CVE-2021-21010InCopy version 15.1.1 (and earlier) for Windows is affected …7
• CVE-2021-21011Adobe Captivate 2019 version 11.5.1.499 (and earlier) is aff…7
• CVE-2021-21012Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier)…5.3
• CVE-2021-21013Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier)…8.1
• CVE-2021-21015Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier)…8
• CVE-2021-21016Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier)…9.1
• CVE-2021-21017Acrobat Reader DC versions versions 2020.013.20074 (and earl…8.8
• CVE-2021-21018Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier)…9.1
• CVE-2021-21019Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier)…9.1
• CVE-2021-2102Vulnerability in the Oracle Complex Maintenance, Repair, and…8.2