What’s Vulnerable › Vulnerabilities

CVE-2021-38295: Privilege escalation vulnerability when using HTML attachments

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-14 · updated 2026-06-17
• Weakness: CWE-79

Description

In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2

Affected products

• Apache Software Foundation Apache CouchDB: before 3.1.2 — fixed in 3.1.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CouchDB 3.1.2. Check the vendor advisory for mitigations.

References

• https://docs.couchdb.org/en/stable/cve/2021-38295.html
• https://docs.couchdb.org/en/stable/cve/2021-38295.html

Get alerted when CVE-2021-38295 or the next vulnerability affects your stack