CVE-2021-44426

An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.5. An upload of an arbitrary file to a victim's local ~/Downloads/ directory is possible if the victim is using the AnyDesk Windows client to connect to a remote machine, if an attacker is also connected remotely with AnyDesk to the same remote machine. The upload is done without any approval or action taken by the victim.

• CWE-434

• https://anydesk.com/en/downloads/windowsProduct, Vendor Advisory
• https://argus-sec.com/discovering-tunneling-service-security-flaws-in-anydesk-remote-application/Exploit, Third Party Advisory
• https://anydesk.com/en/downloads/windowsProduct, Vendor Advisory
• https://argus-sec.com/discovering-tunneling-service-security-flaws-in-anydesk-remote-application/Exploit, Third Party Advisory

Published

Sep 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4442In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2021-44420In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 befo…7.3
• CVE-2021-44421The pointer-validation logic in util/mem_util.rs in Occlum b…5.5
• CVE-2021-44422An Improper Input Validation Vulnerability exists when readi…7.8
• CVE-2021-44423An out-of-bounds read vulnerability exists when reading a BM…7.8
• CVE-2021-44425An issue was discovered in AnyDesk before 6.2.6 and 6.3.x be…6.5
• CVE-2021-44427An unauthenticated SQL Injection vulnerability in Rosario St…9.8
• CVE-2021-44428Pinkie 2.15 allows remote attackers to cause a denial of ser…7.5
• CVE-2021-44429Serva 4.4.0 allows remote attackers to cause a denial of ser…7.5
• CVE-2021-4443The WordPress Mega Menu plugin for WordPress is vulnerable t…9.8
• CVE-2021-44430A vulnerability has been identified in JT Utilities (All ver…7.8
• CVE-2021-44431A vulnerability has been identified in JT Utilities (All ver…3.3