Read the docs
TI-2021-19190 Aliases CVE-2021-43176GHSA-fg34-7vm6-7mc4

Path traversal in GOautodial API

Priority MEDIUM 41CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the action. This permits an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for the attacker to do this without valid credentials. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Why it matters now

EPSS 0.01356 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed GOautodial API (GOautodial): 3c3a979

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GOautodialGOautodial APIbefore 3c3a9793c3a979Patch availableCNA
  • GOautodial API VendorGOautodial Affected before 3c3a979 Fixed in 3c3a979 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:goautodial:goautodial:4:*:*:*:*:*:*:*4VulnerableGOautodial
cpe:2.3:a:goautodial:goautodial_api:2:*:*:*:*:*:*:*2VulnerableGOautodial
  • cpe:2.3:a:goautodial:goautodial:4:*:*:*:*:*:*:* Versions 4 Vulnerable ·GOautodial
  • cpe:2.3:a:goautodial:goautodial_api:2:*:*:*:*:*:*:* Versions 2 Vulnerable ·GOautodial

Remediation

  • Fix · CNA GOautodial API (GOautodial) Fixed in 3c3a979

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43176
  2. 2026-10-03 Alias added: GHSA-fg34-7vm6-7mc4

References

Exploit 1

  • TI-2021-19189 Authentication bypass in GOautodial API CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences