NetSight
IP …
medium5.3

CVE-2021-31865

Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments.

Impact

Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments.

Affected products

VendorProductAffected versions
RedmineRedmine
before 4.0.9
from 4.1.0 before 4.1.3
from 4.2.0 before 4.2.1
DebianDebian Linux
Version 9.0

References