CVE-2021-3846
8.8 HIGHfirefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
Published: 2021-10-19 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 8.8 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-434
Affected products
| Vendor | Product |
|---|---|
| firefly-iii | firefly_iii |
Description
firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3846
- [Patch]https://github.com/firefly-iii/firefly-iii/commit/a85b6420c19ace35134f896e094e1971d8c7954b
- [Patch]https://huntr.dev/bounties/5267ec1c-d204-40d2-bd4f-6c2dd495ee18
- [Patch]https://github.com/firefly-iii/firefly-iii/commit/a85b6420c19ace35134f896e094e1971d8c7954b
- [Patch]https://huntr.dev/bounties/5267ec1c-d204-40d2-bd4f-6c2dd495ee18
Related CVEs
Same vendor
- CVE-2021-3901 — firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) (8.8 HIGH)
- CVE-2021-3900 — firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) (6.5 MEDIUM)
- CVE-2021-3851 — firefly-iii is vulnerable to URL Redirection to Untrusted Site (5.4 MEDIUM)
- CVE-2021-3819 — firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) (8.8 HIGH)
- CVE-2021-3730 — firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF) (6.5 MEDIUM)
Same CWE
- CVE-2026-40750 — Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server (9.9 CRITICAL)
- CVE-2026-6933 — The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and inclu... (8.8 HIGH)
- CVE-2026-40772 — Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions (10.0 CRITICAL)
- CVE-2026-39591 — Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions (9.9 CRITICAL)
- CVE-2026-39527 — Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions (5.4 MEDIUM)