TI-2021-16248 Aliases CVE-2021-38675 GHSA-7w8q-hxwf-h27x

Stored XSS Vulnerability in Image2PDF

LOW 25CWE-79Published 2021-10-01 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Image2PDF: Image2PDF 2.1.5 ( 2021/08/17 ) and later

Why it matters now

EPSS 0.00599 48th percentileScored 2026-11-07

Fix Fixed Image2PDF (QNAP Systems Inc.): 2.1.5 ( 2021/08/17 )

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
QNAP	Image2PDF	before 2.1.5 ( 2021/08/17 )	2.1.5 ( 2021/08/17 )	Patch available	CNA

Image2PDF VendorQNAP Affected before 2.1.5 ( 2021/08/17 ) Fixed in 2.1.5 ( 2021/08/17 ) Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:qnap:image2pdf::::::::	before 2.1.5	Vulnerable	QNAP
cpe:2.3:h:qnap:nas:-:::::::*	not specified by NVD	Running on	QNAP

cpe:2.3:a:qnap:image2pdf:*:*:*:*:*:*:*:* Versions before 2.1.5 Vulnerable ·QNAP
cpe:2.3:h:qnap:nas:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·QNAP

Remediation

Fix · CNA Image2PDF (QNAP Systems Inc.) Fixed in 2.1.5 ( 2021/08/17 )

Timeline

2026-10-02 Threatist record created from CVE-2021-38675
2026-10-03 Alias added: GHSA-7w8q-hxwf-h27x

References

Advisory 1

https://www.qnap.com/en/security-advisory/qsa-21-43

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences