CVE-2021-41185

Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has been applied and a release made. Users should upgrade to version 8.12.7. As a workaround, users may manually apply the changes from the fix commit.

• CWE-22

• https://github.com/kizniche/Mycodo/commit/23ac5dd422029c2b6ae1701a3599b6d41b66a6a9Patch, Third Party Advisory
• https://github.com/kizniche/Mycodo/issues/1105Issue Tracking, Third Party Advisory
• https://github.com/kizniche/Mycodo/releases/tag/v8.12.7Release Notes, Third Party Advisory
• https://github.com/kizniche/Mycodo/security/advisories/GHSA-252r-94ph-m229Patch, Third Party Advisory
• https://github.com/kizniche/Mycodo/commit/23ac5dd422029c2b6ae1701a3599b6d41b66a6a9Patch, Third Party Advisory
• https://github.com/kizniche/Mycodo/issues/1105Issue Tracking, Third Party Advisory
• https://github.com/kizniche/Mycodo/releases/tag/v8.12.7Release Notes, Third Party Advisory
• https://github.com/kizniche/Mycodo/security/advisories/GHSA-252r-94ph-m229Patch, Third Party Advisory

Published

Oct 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4118pytorch-lightning is vulnerable to Deserialization of Untrus…7.8
• CVE-2021-41180Nextcloud talk is a self hosting messaging service. In versi…6.1
• CVE-2021-41181Nextcloud talk is a self hosting messaging service. In versi…2.4
• CVE-2021-41182jQuery-UI is the official jQuery user interface library. Pri…6.1
• CVE-2021-41183jQuery-UI is the official jQuery user interface library. Pri…6.1
• CVE-2021-41184jQuery-UI is the official jQuery user interface library. Pri…6.1
• CVE-2021-41186Fluentd collects events from various data sources and writes…7.5
• CVE-2021-41187DHIS 2 is an information system for data capture, management…8.8
• CVE-2021-41188Shopware is open source e-commerce software. Versions prior …5.4
• CVE-2021-41189DSpace is an open source turnkey repository application. In …7.2
• CVE-2021-4119bookstack is vulnerable to Improper Access Control9.8
• CVE-2021-41190The OCI Distribution Spec project defines an API protocol to…5