CVE-2021-21064: Magento UPWARD-php Path traversal vulnerability via UPWARD Connector

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-25 · updated 2026-06-17
Weakness: CWE-22

Description

Magento UPWARD-php version 1.1.4 (and earlier) is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 (and earlier) due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which allows reading arbitrary files from the remote server. Access to the admin console is required for successful exploitation.

Affected products

Magento Upward Connector: through 1.1.2
Magento Upward Php: through 1.1.4

References

https://github.com/magento/upward-php/security
https://github.com/magento/upward-php/security/advisories/GHSA-p4pw-hpjx-5685
https://github.com/magento/upward-php/security
https://github.com/magento/upward-php/security/advisories/GHSA-p4pw-hpjx-5685

Get alerted when CVE-2021-21064 or the next vulnerability affects your stack