CVE-2021-46062
MCMS Arbitrary File Deletion vulnerability
MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
- Record
CVE-2021-46062- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Updated
- 2026-11-02
CVE List No score
MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
- Record
CVE-2021-46062- Updated
- 2026-11-02
EUVDEUVD-2022-1179 No score
MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
- Record
EUVD-2022-1179- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rpvr-mw7r-25xx
MCMS Arbitrary File Deletion vulnerability
net.mingsoft:ms-basic is used for plugin management for applications built with Maven for the Mingfei Content Management System (MCMS). ms-basic before 2.1.16 is vulnerable to arbitrary file deletion using POST requests to /template/writeFileContent via the oldFileName parameter. MCMS before 5.2.11 is also vulnerable since it bundles vulnerable versions of ms-basic.
- Record
GHSA-rpvr-mw7r-25xx- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-rpvr-mw7r-25xx
MCMS Arbitrary File Deletion vulnerability
net.mingsoft:ms-basic is used for plugin management for applications built with Maven for the Mingfei Content Management System (MCMS). ms-basic before 2.1.16 is vulnerable to arbitrary file deletion using POST requests to /template/writeFileContent via the oldFileName parameter. MCMS before 5.2.11 is also vulnerable since it bundles vulnerable versions of ms-basic.
- Record
GHSA-rpvr-mw7r-25xx- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
net.mingsoft:ms-basicMaven |
before 2.1.16 | 2.1.16 |
net.mingsoft:ms-mcmsMaven |
before 5.2.11 | 5.2.11 |
net.mingsoft:ms-basicMaven |
before 2.1.16, plus listed versions 1.0.01.0.11.0.101.0.111.0.12 Show 45 moreShow less1.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.201.0.211.0.221.0.231.0.241.0.251.0.261.0.271.0.281.0.291.0.301.0.311.0.321.0.331.0.341.0.351.0.361.0.371.0.381.0.51.0.61.0.71.0.81.0.92.1.02.1.12.1.102.1.112.1.122.1.132.1.13.12.1.13.22.1.13.32.1.13.42.1.142.1.14.12.1.152.1.2 |
2.1.16 |
net.mingsoft:ms-mcmsMaven |
before 5.2.11, plus listed versions 4.6.3-SNAPSHOTS4.6.54.7.14.7.25.0.0 Show 15 moreShow less5.0.15.15.25.2.05.2.0.RELEASE5.2.15.2.105.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.9 |
5.2.11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-46062 is a high vulnerability (CVSS 7.1) in Mingsoft Mcms, published February 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in net.mingsoft:ms-basic 2.1.16.
References
Left out here: 6 versions. The JSON record has them.