CVE-2021-26918

The ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the intended purpose of the "Send an image when a user joins the server" feature (or possibly have unspecified other impact) because the uploader web service allows double extensions (such as .html.jpg) with the text/html content type. NOTE: there may not be cases in which an uploader web service is customer controlled; however, the nature of the issue has substantial interaction with customer controlled configuration. NOTE: the vendor states "This is just an uploader (like any other one) which uploads files to cloud storage and accepts various file types. There is no kind of vulnerability and it won't compromise either the client side or the server side.

• CWE-434
• CWE-434

• http://packetstormsecurity.com/files/161347/Discord-Probot-Arbitrary-File-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://raw.githubusercontent.com/TheLastVvV/Vulnerability-Reports-and-CVE/main/Reports/Discord%20Probot%20-%20Unrestricted%20File%20Upload.txtExploit, Third Party Advisory
• http://packetstormsecurity.com/files/161347/Discord-Probot-Arbitrary-File-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://raw.githubusercontent.com/TheLastVvV/Vulnerability-Reports-and-CVE/main/Reports/Discord%20Probot%20-%20Unrestricted%20File%20Upload.txtExploit, Third Party Advisory

Published

Feb 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26912NetMotion Mobility before 11.73 and 12.x before 12.02 allows…8.1
• CVE-2021-26913NetMotion Mobility before 11.73 and 12.x before 12.02 allows…8.1
• CVE-2021-26914NetMotion Mobility before 11.73 and 12.x before 12.02 allows…8.1
• CVE-2021-26915NetMotion Mobility before 11.73 and 12.x before 12.02 allows…8.1
• CVE-2021-26916In nopCommerce 4.30, a Reflected XSS issue in the Discount C…6.1
• CVE-2021-26917PyBitmessage through 0.6.3.2 allows attackers to write scree…5.5
• CVE-2021-26919Apache Druid allows users to read data from other database s…8.8
• CVE-2021-26920In the Druid ingestion system, the InputSource is used for r…6.5
• CVE-2021-26921In util/session/sessionmanager.go in Argo CD before 1.8.4, t…6.5
• CVE-2021-26923An issue was discovered in Argo CD before 1.8.4. Accessing t…7.5
• CVE-2021-26924An issue was discovered in Argo CD before 1.8.4. Browser XSS…6.1
• CVE-2021-26925Roundcube before 1.4.11 allows XSS via crafted Cascading Sty…5.4