What’s Vulnerable › Vulnerabilities

CVE-2021-21245: Pre-Auth Arbitrary File Upload

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-15 · updated 2026-06-17
• Weakness: CWE-434

Description

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder.

Affected products

• theonedev onedev: before 4.0.3 — fixed in 4.0.3

How to fix

Upgrade to a fixed version: theonedev onedev 4.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/theonedev/onedev/commit/0c060153fb97c0288a1917efdb17cc426934dacb
• https://github.com/theonedev/onedev/security/advisories/GHSA-62m2-38q5-96w9
• https://github.com/theonedev/onedev/commit/0c060153fb97c0288a1917efdb17cc426934dacb
• https://github.com/theonedev/onedev/security/advisories/GHSA-62m2-38q5-96w9

Get alerted when CVE-2021-21245 or the next vulnerability affects your stack