CVE-2021-44043

MEDIUM 5.4CVE-2021-44043 · Published 14/12/2021 · updated 17/06/2026

In short

CVE-2021-44043 is a MEDIUM (CVSS 5.4) vulnerability affecting app studio (uipath).
Chance of exploitation in the next 30 days (EPSS): 0.47%, higher than 40.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
app studio uipath	`= 21.4.4`	No fix yet

Description

An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempting to create new Apps. An attacker with minimal privileges in the application can build their own App and upload a malicious file containing an XSS payload, by uploading an arbitrary file and modifying the MIME type in a subsequent HTTP request. This then allows the file to be stored and retrieved from the server by other users in the same organization.

References

docs.uipath.com/apps/v2021.10/docs/2021-10-1 · Release Notes
docs.uipath.com/robot/docs/uipath-assistant · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free