CVE-2021-29246

BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin file with special characters to upload the file outside of the restricted directory.

• CWE-22

• https://blog.btcpayserver.org/vulnerability-disclosure-v1-0-7-0/Vendor Advisory
• https://github.com/btcpayserver/btcpayserver/releasesRelease Notes, Third Party Advisory
• https://blog.btcpayserver.org/vulnerability-disclosure-v1-0-7-0/Vendor Advisory
• https://github.com/btcpayserver/btcpayserver/releasesRelease Notes, Third Party Advisory

Published

May 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29239CODESYS Development System 3 before 3.5.17.0 displays or exe…7.8
• CVE-2021-29240The Package Manager of CODESYS Development System 3 before 3…7.8
• CVE-2021-29241CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer derefe…7.5
• CVE-2021-29242CODESYS Control Runtime system before 3.5.17.0 has improper …7.3
• CVE-2021-29243Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XS…6.1
• CVE-2021-29245BTCPay Server through 1.0.7.0 uses a weak method Next to pro…5.3
• CVE-2021-29247BTCPay Server through 1.0.7.0 could allow a remote attacker …5.3
• CVE-2021-29248BTCPay Server through 1.0.7.0 could allow a remote attacker …5.3
• CVE-2021-29249BTCPay Server before 1.0.6.0, when the payment button is use…7.5
• CVE-2021-29250BTCPay Server through 1.0.7.0 suffers from a Stored Cross Si…5.4
• CVE-2021-29251BTCPay Server before 1.0.7.1 mishandles the policy setting i…6.5
• CVE-2021-29252RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS…5.4