CVE-2021-43266

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-02 · updated 2026-06-17
Weakness: CWE-78

Description

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution

Affected products

mahara: from 20.04.0 before 20.04.5; from 20.10.0 before 20.10.3; from 21.04.0 before 21.04.2; from 20.10.0 before 20.10.4; from 21.04.0 before 21.04.3; from 21.10.0 before 21.10.1 — fixed in 20.04.5, 20.10.3, 20.10.4, 21.04.2, 21.04.3, 21.10.1

How to fix

Upgrade to a fixed version: mahara 20.04.5, 20.10.3, 20.10.4, 21.04.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-43266 or the next vulnerability affects your stack