CVE-2021-33564

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.

• CWE-88

• https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5Patch, Third Party Advisory
• https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0Patch, Third Party Advisory
• https://github.com/markevans/dragonfly/issues/513Issue Tracking, Third Party Advisory
• https://github.com/mlr0p/CVE-2021-33564Exploit, Third Party Advisory
• https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-33564.yamlExploit, Third Party Advisory
• https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/Exploit, Third Party Advisory
• https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5Patch, Third Party Advisory
• https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0Patch, Third Party Advisory
• https://github.com/markevans/dragonfly/issues/513Issue Tracking, Third Party Advisory
• https://github.com/mlr0p/CVE-2021-33564Exploit, Third Party Advisory
• https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-33564.yamlExploit, Third Party Advisory
• https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/Exploit, Third Party Advisory

Published

May 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33557An XSS issue was discovered in manage_custom_field_edit_page…6.1
• CVE-2021-33558Boa 0.94.13 allows remote attackers to obtain sensitive info…7.5
• CVE-2021-33560Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElG…7.5
• CVE-2021-33561A stored cross-site scripting (XSS) vulnerability in Shopize…4.8
• CVE-2021-33562A reflected cross-site scripting (XSS) vulnerability in Shop…4.8
• CVE-2021-33563Koel before 5.1.4 lacks login throttling, lacks a password s…7.5
• CVE-2021-33570Postbird 0.8.4 allows stored XSS via the onerror attribute o…5.4
• CVE-2021-33571In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 befo…7.5
• CVE-2021-33572A Denial-of-Service (DoS) vulnerability was discovered in F-…6.5
• CVE-2021-33574The mq_notify function in the GNU C Library (aka glibc) vers…9.8
• CVE-2021-33575The Pixar ruby-jss gem before 1.6.0 allows remote attackers …9.8
• CVE-2021-33576An issue was discovered in Cleo LexiCom 5.5.0.0. Within the …9.8