What’s Vulnerable › Vulnerabilities

CVE-2021-26612: tobesoft Nexacro platform arbitrary file creation vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-30 · updated 2026-06-17
• Weakness: CWE-20

Description

An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code.

Affected products

• TOBESOFT NEXACRO17: through 17.1.2.500

References

• https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36380
• https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36380

Get alerted when CVE-2021-26612 or the next vulnerability affects your stack