{"id":"CVE-2021-42342","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-42342","generatedAt":"2026-11-05T01:03:21.741Z","title":"This permits tunneling untrusted environment variables into vulnerable CGI scripts.","description":"An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. This permits tunneling untrusted environment variables into vulnerable CGI scripts.","published":"2021-10-14T06:15:07.000Z","lastModified":"2026-06-17T04:09:41.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-434"],"affected":["embedthis/goahead"],"epss":{"score":0.5946,"percentile":0.99123,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 59.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://github.com/embedthis/goahead/issues/305","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/embedthis/goahead/issues/305","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-42342","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}