TI-2021-06193 Aliases CVE-2021-23803 GHSA-6pj2-5fqq-xvjc

Access control bypass in latte/latte

MEDIUM 45CWE-863Published 2021-12-17 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.

Why it matters now

EPSS 0.01628 76th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed latte/latte: 2.10.6latte/latte (Packagist): 2.10.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	latte/latte	before 2.10.6	2.10.6	Patch available	CNA
—	latte/latte (Packagist)	before 2.10.6	2.10.6	Patch available	GHSA-6pj2-5fqq-xvjc

latte/latte Vendor— Affected before 2.10.6 Fixed in 2.10.6 Patch available CNA
latte/latte (Packagist) Vendor— Affected before 2.10.6 Fixed in 2.10.6 Patch available GHSA-6pj2-5fqq-xvjc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nette:latte::::::::	before 2.10.6	Vulnerable	nette

cpe:2.3:a:nette:latte:*:*:*:*:*:*:*:* Versions before 2.10.6 Vulnerable ·nette

Remediation

Fix · CNA latte/latte Fixed in 2.10.6
Fix · GHSA-6pj2-5fqq-xvjc latte/latte (Packagist) Fixed in 2.10.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-23803
2026-10-03 Alias added: GHSA-6pj2-5fqq-xvjc

References

TI-2022-06026 Sandbox bypass in Latte templates CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences