CVE-2021-27230

Description

ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under the system/user/language directory.

Weakness classification

• nvd@nist.gov: CWE-94

Primary references

• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Vendor Advisory
• cve@mitre.org — Permissions Required, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Third Party Advisory