What’s Vulnerable › Vulnerabilities

CVE-2021-21269: Path Traversal in Keymaker

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-20 · updated 2026-06-17
• Weakness: CWE-22

Description

Keymaker is a Mastodon Community Finder based Matrix Community serverlist page Server. In Keymaker before version 0.2.0, the assets endpoint did not check for the extension. The rust `join` method without checking user input might have made it abe to do a Path Traversal attack causing to read more files than allowed. This is fixed in version 0.2.0.

Affected products

• keymaker-mx keymaker: before 0.2.0 — fixed in 0.2.0

How to fix

Upgrade to a fixed version: keymaker-mx keymaker 0.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/keymaker-mx/keymaker/commit/63f3012b390ff1519a84100df9e5dff5058bb926
• https://github.com/keymaker-mx/keymaker/security/advisories/GHSA-pg25-xfcf-vjvm
• https://github.com/keymaker-mx/keymaker/commit/63f3012b390ff1519a84100df9e5dff5058bb926
• https://github.com/keymaker-mx/keymaker/security/advisories/GHSA-pg25-xfcf-vjvm

Get alerted when CVE-2021-21269 or the next vulnerability affects your stack