What’s Vulnerable › Vulnerabilities

CVE-2021-38621

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-13 · updated 2026-06-17

Description

The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership.

Affected products

• Netless Flat Server: before 2021-07-30 — fixed in 2021-07-30

How to fix

Upgrade to a fixed version: Netless Flat Server 2021-07-30. Check the vendor advisory for mitigations.

References

• https://github.com/netless-io/flat-server/commit/425aa970f6366874c61aa1466527fced5501e476
• https://github.com/netless-io/flat-server/commit/425aa970f6366874c61aa1466527fced5501e476

Get alerted when CVE-2021-38621 or the next vulnerability affects your stack