{"id":"CVE-2021-40870","kind":"vulnerability","aliases":["CVE-2021-40870"],"related":[],"title":"Aviatrix Aviatrix Controller: Aviatrix Controller Unrestricted Upload of File","description":"An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.","summary":"Aviatrix Controller accepts file uploads of dangerous types without restriction, and a directory traversal in the upload path lets an unauthenticated attacker write files anywhere. The sources say this leads to arbitrary code execution, and CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":0.93019,"exploited":true,"exploited_at":"2022-01-18T00:00:00+00:00","products":[{"name":"Aviatrix Aviatrix Controller","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aviatrix","cloud-networking","exploited","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the vendor update per Aviatrix instructions; the fixed version is unknown from the sources.","status":"open","published_at":"2021-09-13T08:15:13+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:36+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T21:31:36Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Aviatrix instructions; the fixed version is unknown from the sources.","reach":"internet","impact":"high","summary":"Aviatrix Controller accepts file uploads of dangerous types without restriction, and a directory traversal in the upload path lets an unauthenticated attacker write files anywhere. The sources say this leads to arbitrary code execution, and CISA lists it as actively exploited.","category":"vendor","who_cares":["aviatrix","cloud-networking","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code on the controller server.","analyst_note":"Find the affected and fixed Aviatrix Controller versions and the vendor advisory, and a log or file path indicating exploitation; check CISA KEV entry for CVE-2021-40870.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000472,"input_tokens":2839,"output_tokens":376,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected and fixed Aviatrix Controller versions and the vendor advisory, and a log or file path indicating exploitation; check CISA KEV entry for CVE-2021-40870.","search":"'-1804.1922':80C '-2021':11A,14A '-40870':12A,15A '6':76C '6.5':79C 'accept':30B 'activ':67B 'allow':93C 'anywher':52B 'arbitrari':59B,99C 'attack':49B 'aviatrix':1A,2A,4A,16A,17A,19B,28B,74C 'cisa':63B 'cloud':21B 'cloud-network':20B 'code':60B,100C 'control':3A,5A,29B,75C 'controller':18A 'cve':10A,13A 'danger':34B,88C 'directori':40B,102C 'discov':72C 'execut':61B,98C 'exploit':23B,68B 'file':9A,31B,51B,85C 'host':26B 'issu':70C 'lead':57B 'let':46B 'list':64B 'network':22B 'path':45B 'possibl':91C 'restrict':37B 'say':55B 'self':25B 'self-host':24B 'sourc':54B 'travers':41B,103C 'type':35B,89C 'unauthent':48B,95C 'unrestrict':6A,81C 'upload':7A,32B,44B,82C 'user':96C 'vendor':27B 'via':101C 'without':36B 'write':50B 'x':77C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-13T08:15:13+00:00","kev":{"dateAdded":"2022-01-18","dueDate":"2022-02-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-40870","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-40870","severity":null,"published_at":"2022-01-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2021-40870","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40870","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-40870","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40870","severity":null,"published_at":"2021-09-13T08:15:13+00:00","modified_at":"2026-06-17T04:07:34+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}