Incorrect Default Permissions in Apache JSPWiki

CRITICAL 9.1CVE-2021-44140 · GHSA-8gw6-w5rw-4g5c · Published 24/11/2021 · updated 17/06/2026

In short

CVE-2021-44140 is a CRITICAL (CVSS 9.1) vulnerability affecting org.apache.jspwiki:jspwiki-main, jspwiki (apache).
Chance of exploitation in the next 30 days (EPSS): 6.4%, higher than 93.7% of all vulnerabilities.
Fix: update to 2.11.0 or later.

Package	Affected versions	Patched versions
org.apache.jspwiki:jspwiki-main Maven	`< 2.11.0`	`2.11.0`
jspwiki apache	`< 2.11.0`	`2.11.0`

Description

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2021-44140 · ADVISORY
apache/jspwiki · PACKAGE
jspwiki-wiki.apache.org/Wiki.jsp · WEB
lists.apache.org/thread/5qglpjdhvobppx7j550lf1sk28f6011t · WEB

More vulnerabilities in org.apache.jspwiki:jspwiki-main

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.jspwiki:jspwiki-main

Maven

< 2.11.0

2.11.0

jspwiki

apache

< 2.11.0

2.11.0

Description

NVD description

More vulnerabilities in org.apache.jspwiki:jspwiki-main

See all →