CVE-2021-41566: Tad TadTools - Arbitrary File Upload

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-08 · updated 2026-06-17
Weakness: CWE-434

Description

The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.

Affected products

TadTools: before 3.2.2 — fixed in 3.2.2

How to fix

Upgrade to a fixed version: TadTools 3.2.2. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/tw/cp-132-5170-83472-1.html
https://www.twcert.org.tw/tw/cp-132-5170-83472-1.html

Get alerted when CVE-2021-41566 or the next vulnerability affects your stack