{"id":"CVE-2021-46062","aliases":["EUVD-2022-1179","GHSA-rpvr-mw7r-25xx"],"status":"published","title":"MCMS Arbitrary File Deletion vulnerability","description":"MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00767,"percentile":0.55951,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2022-02-18T19:36:41Z","modified":"2026-06-17T04:14:28Z","fixes":[{"ecosystem":"Maven","package":"net.mingsoft:ms-basic","fixed_in":["2.1.16"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"net.mingsoft:ms-mcms","fixed_in":["5.2.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.mingsoft:ms-basic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"net.mingsoft:ms-mcms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.11"}]}]},{"source":"osv","ecosystem":"Maven","package":"net.mingsoft:ms-basic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.16"}]}],"versions":["1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","1.0.30","1.0.31","1.0.32","1.0.33","1.0.34","1.0.35","1.0.36","1.0.37","1.0.38","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.13.1","2.1.13.2","2.1.13.3","2.1.13.4","2.1.14","2.1.14.1","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8"]},{"source":"osv","ecosystem":"Maven","package":"net.mingsoft:ms-mcms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.11"}]}],"versions":["4.6.3-SNAPSHOTS","4.6.5","4.7.1","4.7.2","5.0.0","5.0.1","5.1","5.2","5.2.0","5.2.0.RELEASE","5.2.1","5.2.10","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9"]}],"products":[{"vendor":"mingsoft","product":"mcms"}],"references":[{"url":"https://github.com/ming-soft/MCMS/issues/59","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46062","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rpvr-mw7r-25xx"}],"sources":{"cve":[{"id":"CVE-2021-46062","description":"MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.","status":"published","published":"2022-02-18T19:36:41Z","modified":"2024-08-04T04:54:31.319Z","updated_at":"2026-11-02T14:33:03.320536Z"}],"euvd":[{"id":"EUVD-2022-1179","description":"MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.","status":"published","published":"2022-02-18T19:36:41Z","modified":"2024-08-04T04:54:31Z","updated_at":"2026-11-03T03:08:24.682864Z"}],"ghsa":[{"id":"GHSA-rpvr-mw7r-25xx","title":"MCMS Arbitrary File Deletion vulnerability","description":"`net.mingsoft:ms-basic` is used for plugin management for applications built with Maven for the [Mingfei Content Management System (MCMS)](https://gitee.com/mingSoft/MCMS). ms-basic before 2.1.16 is vulnerable to arbitrary file deletion using POST requests to `/template/writeFileContent` via the `oldFileName` parameter. MCMS before 5.2.11 is also vulnerable since it bundles vulnerable versions of ms-basic.","status":"published","published":"2022-02-19T00:01:24Z","modified":"2023-09-25T15:44:10Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:06.234371Z"}],"nvd":[{"id":"CVE-2021-46062","description":"MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.","status":"published","published":"2022-02-18T20:15:11.427Z","modified":"2026-06-17T04:14:28.63Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:04.6896Z"}],"osv":[{"id":"GHSA-rpvr-mw7r-25xx","title":"MCMS Arbitrary File Deletion vulnerability","description":"`net.mingsoft:ms-basic` is used for plugin management for applications built with Maven for the [Mingfei Content Management System (MCMS)](https://gitee.com/mingSoft/MCMS). ms-basic before 2.1.16 is vulnerable to arbitrary file deletion using POST requests to `/template/writeFileContent` via the `oldFileName` parameter. MCMS before 5.2.11 is also vulnerable since it bundles vulnerable versions of ms-basic.","status":"published","published":"2022-02-19T00:01:24Z","modified":"2024-02-16T08:11:34.370877Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:56.281047Z"}]}}