CVE-2021-43176

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the action. This permits an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for the attacker to do this without valid credentials. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

• CWE-23
• CWE-22

• https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilitiesExploit, Third Party Advisory
• https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilitiesExploit, Third Party Advisory

Published

Dec 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4317Use after free in ANGLE in Google Chrome prior to 96.0.4664.…8.8
• CVE-2021-43171Improper verification of applications' cryptographic signatu…6.5
• CVE-2021-43172NLnet Labs Routinator prior to 0.10.2 happily processes a ch…7.5
• CVE-2021-43173In NLnet Labs Routinator prior to 0.10.2, a validation run c…7.5
• CVE-2021-43174NLnet Labs Routinator versions 0.9.0 up to and including 0.1…7.5
• CVE-2021-43175The GOautodial API prior to commit 3c3a979 made on October 1…7.5
• CVE-2021-43177As a result of an incomplete fix for CVE-2015-7225, in versi…5.3
• CVE-2021-43178Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43179Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-4318Object corruption in Blink in Google Chrome prior to 94.0.46…8.8
• CVE-2021-43180In JetBrains Hub before 2021.1.13690, information disclosure…7.5
• CVE-2021-43181In JetBrains Hub before 2021.1.13690, stored XSS is possible…6.1