CVE-2021-33564

Name: CVE-2021-33564
Creator: NVD / NIST
Published: 2021-05-29T14:15:08.51+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 72.25%

Last modified Jun 17, 2026

CVE-2021-33564 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. EPSS estimates a 72.25% chance of exploitation in the next 30 days.

Description

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

72.25%

99.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-88

Affected Software

Vendor	Product	Versions
Dragonfly Project	Dragonfly	< 1.4.0

References

https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5Patch, Third Party Advisory
https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0Patch, Third Party Advisory
https://github.com/markevans/dragonfly/issues/513Issue Tracking, Third Party Advisory
https://github.com/mlr0p/CVE-2021-33564Exploit, Third Party Advisory
https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-33564.yamlExploit, Third Party Advisory
https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/Exploit, Third Party Advisory
https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5Patch, Third Party Advisory
https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0Patch, Third Party Advisory
https://github.com/markevans/dragonfly/issues/513Issue Tracking, Third Party Advisory
https://github.com/mlr0p/CVE-2021-33564Exploit, Third Party Advisory
https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-33564.yamlExploit, Third Party Advisory
https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/Exploit, Third Party Advisory

Timeline

Published: May 29, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-33564?

How severe is CVE-2021-33564?

CVE-2021-33564 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 72.25% probability of exploitation in the next 30 days.

How do I fix CVE-2021-33564?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-33564?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST