CVE-2021-43266

HIGH 7.3CVE-2021-43266 · Published 02/11/2021 · updated 17/06/2026

In short

CVE-2021-43266 is a HIGH (CVSS 7.3) vulnerability affecting mahara (mahara).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 71.0% of all vulnerabilities.
Fix: update to 20.04.5, 20.10.3, 20.10.4, 21.04.2 or later.

Package	Affected versions	Patched versions
mahara mahara	`≥ 20.04.0, < 20.04.5≥ 20.10.0, < 20.10.3≥ 20.10.0, < 20.10.4≥ 21.04.0, < 21.04.2≥ 21.04.0, < 21.04.3≥ 21.10.0, < 21.10.1`	`20.04.520.10.320.10.421.04.221.04.321.10.1`

Description

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution

References

bugs.launchpad.net/mahara/+bug/1942903 · Exploit
bugs.launchpad.net/mahara/+bug/1949527 · Third Party Advisory
mahara.org/interaction/forum/topic.php · Vendor Advisory
mahara.org/interaction/forum/topic.php · Vendor Advisory

More vulnerabilities in mahara

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mahara

≥ 20.04.0, < 20.04.5≥ 20.10.0, < 20.10.3≥ 20.10.0, < 20.10.4≥ 21.04.0, < 21.04.2≥ 21.04.0, < 21.04.3≥ 21.10.0, < 21.10.1

20.04.520.10.320.10.421.04.221.04.321.10.1

More vulnerabilities in mahara

See all →