CVE-2021-44164: Chain Sea Information Integration Co., Ltd ai chatbot system - Arbitrary File Upload

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-20 · updated 2026-06-17
Weakness: CWE-434

Description

Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or terminate service.

Affected products

Chinasea Qb Smart Service Robot: all versions

References

https://www.twcert.org.tw/tw/cp-132-5400-c31d1-1.html
https://www.twcert.org.tw/tw/cp-132-5400-c31d1-1.html

Get alerted when CVE-2021-44164 or the next vulnerability affects your stack