Vulnerability · Published Oct 8, 2021 · Assigned by twcert

CVE-2021-41566Tad TadTools - Arbitrary File Upload

Critical 9.8

In plain English

A critical-severity unrestricted file upload in TadTools from Tad. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.0%top 19.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.

Affected products (as reported)

Vendor	Product	Versions
Tad	TadTools	0 – through 3.2.1

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.twcert.org.tw/tw/cp-132-5170-83472-1.html x_refsource_MISC