What’s Vulnerable › Vulnerabilities

CVE-2021-23803: Access Control Bypass

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-17 · updated 2026-06-17
• Weakness: CWE-863

Description

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.

Affected products

• nette latte: before 2.10.6 — fixed in 2.10.6

How to fix

Upgrade to a fixed version: nette latte 2.10.6. Check the vendor advisory for mitigations.

References

• https://github.com/nette/latte/commit/227c86eda9a8a6d060ea8501923e768b6d992210
• https://github.com/nette/latte/issues/279
• https://snyk.io/vuln/SNYK-PHP-LATTELATTE-1932226
• https://github.com/nette/latte/commit/227c86eda9a8a6d060ea8501923e768b6d992210
• https://github.com/nette/latte/issues/279
• https://snyk.io/vuln/SNYK-PHP-LATTELATTE-1932226

Get alerted when CVE-2021-23803 or the next vulnerability affects your stack