XpressEngine file upload vulnerability
Priority MEDIUM 51CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-434.
Summary
When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0121 68th percentileScored 2026-11-07
Fix Fixed xpressengine/xpressengine (Packagist): 3.0.15
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| XEHub | XE3 XpresesEngine | 3.0.14 – 3.0.14 | — | No fix listed | CNA |
| — | xpressengine/xpressengine (Packagist) | before 3.0.15 | 3.0.15 | Patch available | GHSA-8r5j-22j5-w4cm |
- XE3 XpresesEngine VendorXEHub Affected 3.0.14 – 3.0.14 Fixed in — No fix listed CNA
- xpressengine/xpressengine (Packagist) Vendor— Affected before 3.0.15 Fixed in 3.0.15 Patch available GHSA-8r5j-22j5-w4cm
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xpressengine:xpressengine:*:*:*:*:*:*:*:* | before 3.0.14 | Vulnerable | Xpressengine |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:xpressengine:xpressengine:*:*:*:*:*:*:*:* Versions before 3.0.14 Vulnerable ·Xpressengine
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · GHSA-8r5j-22j5-w4cm xpressengine/xpressengine (Packagist) Fixed in 3.0.15 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26642
- 2026-10-03 Alias added: GHSA-8r5j-22j5-w4cm
References
More Xpressengine vulnerabilities
- TI-2011-04606 XpressEngine Update Query sql injection CVSS 3.1CRITICAL 9.8
- TI-2021-20326 In XE 1.116, when uploading the Normal button, there is no restriction on the file… CVSS 3.1MEDIUM 5.4
- TI-2021-20325 XE before 1.11.6 is vulnerable to Unrestricted file upload via… CVSS 3.1MEDIUM 5.4
Sources
- CVE-2021-26642 · CVE Program
- CVE-2021-26642 · NVD
- FIRST EPSS
- GHSA-8r5j-22j5-w4cm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences