CVE-2021-43788

Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.

• CWE-22

• https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/Exploit, Third Party Advisory
• https://github.com/NodeBB/NodeBB/commit/c8b2fc46dc698db687379106b3f01c71b80f495fPatch, Third Party Advisory
• https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5Release Notes, Third Party Advisory
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-pfj7-2qfw-vwgmThird Party Advisory
• https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/Exploit, Third Party Advisory
• https://github.com/NodeBB/NodeBB/commit/c8b2fc46dc698db687379106b3f01c71b80f495fPatch, Third Party Advisory
• https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5Release Notes, Third Party Advisory
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-pfj7-2qfw-vwgmThird Party Advisory

Published

Nov 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43782Tuleap is a Libre and Open Source tool for end to end tracea…7.2
• CVE-2021-43783@backstage/plugin-scaffolder-backend is the backend for the …8.5
• CVE-2021-43784runc is a CLI tool for spawning and running containers on Li…5
• CVE-2021-43785@joeattardi/emoji-button is a Vanilla JavaScript emoji picke…6.1
• CVE-2021-43786Nodebb is an open source Node.js based forum software. In af…7.5
• CVE-2021-43787Nodebb is an open source Node.js based forum software. In af…6.1
• CVE-2021-43789PrestaShop is an Open Source e-commerce web application. Ver…9.8
• CVE-2021-4379The WooCommerce Multi Currency plugin for WordPress is vulne…6.5
• CVE-2021-43790Lucet is a native WebAssembly compiler and runtime. There is…8.1
• CVE-2021-43791Zulip is an open source group chat application that combines…5.3
• CVE-2021-43792Discourse is an open source discussion platform. In affected…4.3
• CVE-2021-43793Discourse is an open source discussion platform. In affected…4.3