CVE-2021-46897
Wagtail CRX CodeRed Extensions vulnerable to Path Traversal
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.
- Record
CVE-2021-46897- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.
- Record
CVE-2021-46897- Updated
- 2026-11-02
EUVDEUVD-2023-0054 No score
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.
- Record
EUVD-2023-0054- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h454-rq3m-89rc
Wagtail CRX CodeRed Extensions vulnerable to Path Traversal
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.
- Record
GHSA-h454-rq3m-89rc- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.
- Record
CVE-2021-46897- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-h454-rq3m-89rc
Wagtail CRX CodeRed Extensions vulnerable to Path Traversal
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.
- Record
GHSA-h454-rq3m-89rc- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVPYSEC-2023-210 No score
views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.
- Record
PYSEC-2023-210- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
coderedcmsPyPI |
before 0.22.3 | 0.22.3 |
coderedcmsPyPI |
before 0.22.3, plus listed versions 0.10.00.11.00.12.00.12.10.13.0 Show 33 moreShow less0.13.10.13.20.13.30.14.00.14.10.15.00.15.10.15.20.16.00.16.10.16.20.16.30.17.00.18.00.18.10.18.20.19.00.19.0rc10.19.10.20.00.21.00.21.10.22.00.22.10.22.20.5.00.5.10.6.00.7.00.7.10.8.00.9.00.9.1 |
0.22.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-46897 is a medium vulnerability (CVSS 6.5) in Wagtailcrx Codered Extensions, published October 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in coderedcms 0.22.3.
References
github.com/coderedcorp/coderedcms/issues/448
nvd.nist.gov/vuln/detail/CVE-2021-46897