CVE-2021-27931

CRITICAL 9.1CVE-2021-27931 · Published 03/03/2021 · updated 17/06/2026

In short

CVE-2021-27931 is a CRITICAL (CVSS 9.1) vulnerability affecting lumis experience platform (lumis).
Chance of exploitation in the next 30 days (EPSS): 18.1%, higher than 97.2% of all vulnerabilities.
Fix: update to 10.0.0 or later.

Package	Affected versions	Patched versions
lumis experience platform lumis	`< 10.0.0`	`10.0.0`

Description

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.

References

sl4cky/LumisXP-XXE---POC · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free