CVE-2021-42171
Unrestricted Upload of File with Dangerous Type in Zenario CMS
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
- Record
CVE-2021-42171- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
- Record
CVE-2021-42171- Updated
- 2026-11-02
EUVDEUVD-2022-1532 No score
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
- Record
EUVD-2022-1532- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rgg3-3wh7-w935
Unrestricted Upload of File with Dangerous Type in Zenario CMS
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
- Record
GHSA-rgg3-3wh7-w935- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
OSV
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
- Record
CVE-2021-42171- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-rgg3-3wh7-w935
Unrestricted Upload of File with Dangerous Type in Zenario CMS
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
- Record
GHSA-rgg3-3wh7-w935- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tribalsystems/zenarioPackagist |
through 9.0.54156 | 9.0.55143 |
tribalsystems/zenarioPackagist |
before 9.0.55143, plus listed versions 7.5.404407.5.410067.5.414997.5.416337.5.42085 Show 45 moreShow less7.5.429907.5.471807.6.415047.6.416337.6.420857.6.429907.6.471807.7.426827.7.429637.7.429907.7.442237.7.471807.7.473697.7.485838.0.442378.0.442738.0.442948.0.445218.0.450328.0.452508.0.455298.0.471808.0.485838.1.455308.1.456988.1.460898.1.464338.1.466158.1.471808.1.473698.1.485838.2.464368.2.466148.2.471808.2.473698.2.479928.2.485838.3.479978.3.485838.3.505648.4.505658.4.513408.5.505678.5.508378.5.51340 |
9.0.55143 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | minhnq22/CVE-2021-42171 | 2021-09-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-42171 is a high vulnerability (CVSS 7.2) in Tribalsystems Zenario, published March 14, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.52%, the 84th percentile. Fixed in tribalsystems/zenario 9.0.55143.
References
minhnq22.medium.com/file-upload-to-rce-on-zenario-9-0-54156-cms-fa05fcc6cf74
github.com/hieuminhnv/Zenario-CMS-9.0-last-version/issues/2
packetstormsecurity.com/files/166617/Zenario-CMS-9.0.54156-Remote-Code-Execution.html
nvd.nist.gov/vuln/detail/CVE-2021-42171
Left out here: 12 versions. The JSON record has them.