CVE-2021-3029

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-07 · updated 2026-06-17
Weakness: CWE-78

Description

EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products

Evolucare Ecs Imaging: through 6.21.5

References

https://shoxxdj.fr/ecsimaging-os-injection-cve-2021-3029/
https://www.evolucare.com
https://shoxxdj.fr/ecsimaging-os-injection-cve-2021-3029/
https://www.evolucare.com

Get alerted when CVE-2021-3029 or the next vulnerability affects your stack