What’s Vulnerable › Vulnerabilities

CVE-2021-26293

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-03-04 · updated 2026-06-17
• Weakness: CWE-22

Description

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.

Affected products

• Afterlogic Aurora: through 8.5.3
• Afterlogic Webmail Pro: through 8.5.3

References

• https://auroramail.wordpress.com/2021/02/03/addressing-dav-related-vulnerability-in-webmail-and-aurora/
• https://auroramail.wordpress.com/2021/02/03/addressing-dav-related-vulnerability-in-webmail-and-aurora/

Get alerted when CVE-2021-26293 or the next vulnerability affects your stack