CVE-2021-41824

HIGH

Craft CMS 3.4.0-3.7.13 - CSV Injection

Title source: llm

Craft CMS before 3.7.14 allows CSV injection.

Core 3

Core References

Release Notes, Third Party Advisory x_refsource_misc

Third Party Advisory x_refsource_misc

Third Party Advisory x_refsource_misc

CVSS v3 8.8

EPSS 0.0133

EPSS Percentile 67.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-1236

Status published

Products (2)

craftcms/cms 3.4.0 - 3.7.14Packagist

craftcms/craft_cms 3.4.0 - 3.7.14

Published Sep 30, 2021

Tracked Since Feb 18, 2026