CVE-2021-29377

Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers...

9.8 Critical

CVE-2021-29377 is a critical vulnerability (CVSS 9.8) in Pearadmin Think, published August 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. No source names a fixed version.

Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded via admin.php/index/upload because app/common/service/UploadService.php mishandles fileExt.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.60%Up 0.9 points since Aug 13, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2021-29377
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-434
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-29377
Updated: 2026-11-02

EUVDEUVD-2021-16012 No score

Record: EUVD-2021-16012
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7jv3-m85g-h6v2 No score

Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers...

Record: GHSA-7jv3-m85g-h6v2
Weakness: CWE-434
Updated: 2026-11-02

Affected products

pearadmin think

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD