CVE-2021-21064

Name: CVE-2021-21064
Creator: NVD / NIST
Published: 2021-02-25T14:15:12.143+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 8.51%

Last modified Jun 17, 2026

CVE-2021-21064 is a vulnerability of currently unknown severity. Magento UPWARD-php version 1.1.4 (and earlier) is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 (and earlier) due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which allows reading arbitrary files from the remote server. EPSS estimates a 8.51% chance of exploitation in the next 30 days.

Description

Magento UPWARD-php version 1.1.4 (and earlier) is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 (and earlier) due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which allows reading arbitrary files from the remote server. Access to the admin console is required for successful exploitation.

Metrics

EPSS Probability

8.51%

94.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-22

Affected Software

Vendor	Product	Versions
Magento	Upward Connector	<= 1.1.2
Magento	Upward Php	<= 1.1.4

References

https://github.com/magento/upward-php/securityThird Party Advisory
https://github.com/magento/upward-php/security/advisories/GHSA-p4pw-hpjx-5685Third Party Advisory
https://github.com/magento/upward-php/securityThird Party Advisory
https://github.com/magento/upward-php/security/advisories/GHSA-p4pw-hpjx-5685Third Party Advisory

Timeline

Published: Feb 25, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-21064?

How severe is CVE-2021-21064?

Severity scoring for CVE-2021-21064 is pending analysis. The EPSS model estimates a 8.51% probability of exploitation in the next 30 days.

How do I fix CVE-2021-21064?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-21064?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST