CVE-2021-41792

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-21 · updated 2026-06-17
Weakness: CWE-918

Description

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to the attacker, i.e., this is blind SSRF.

Affected products

Alfresco Content Services: from 5.0.0.0 through 5.2.7.11; from 6.0.0.0 through 6.0.1.9; from 6.1.1.0 through 6.1.1.10; from 6.2.0.0 through 6.2.2.18
Alfresco Transform Services: through 1.3

References

https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.md
https://www.themissinglink.com.au/
https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.md
https://www.themissinglink.com.au/

Get alerted when CVE-2021-41792 or the next vulnerability affects your stack