An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3…
Priority MEDIUM 52CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.
Why it matters now
EPSS 0.0711 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:afterlogic:aurora:*:*:*:*:*:*:*:* | up to 8.5.3 | Vulnerable | Afterlogic |
| cpe:2.3:a:afterlogic:webmail_pro:*:*:*:*:*:*:*:* | up to 8.5.3 | Vulnerable | Afterlogic |
- cpe:2.3:a:afterlogic:aurora:*:*:*:*:*:*:*:* Versions up to 8.5.3 Vulnerable ·Afterlogic
- cpe:2.3:a:afterlogic:webmail_pro:*:*:*:*:*:*:*:* Versions up to 8.5.3 Vulnerable ·Afterlogic
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26293
- 2026-10-03 Alias added: GHSA-77v9-4x76-g7mj
References
More Afterlogic Aurora vulnerabilities
- TI-2021-08128 An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. CVSS 3.1HIGH 7.5
- TI-2019-13802 Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name. CVSS 3.1MEDIUM 6.1
- TI-2019-12220 Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session… CVSS 3.1MEDIUM 6.1
- TI-2017-10698 AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field… CVSS 3.0MEDIUM 4.8
Sources
- CVE-2021-26293 · CVE Program
- CVE-2021-26293 · NVD
- FIRST EPSS
- GHSA-77v9-4x76-g7mj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences