How severe is CVE-2021-27112?

CVE-2021-27112 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-27112 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-27112?

CVE-2021-27112 affects Lightcms Project Lightcms. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-27112?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2021-27112 published?

CVE-2021-27112 was published on 2021-04-15 and last updated on 2026-06-17.

CVE-2021-27112

CVE-2021-27112 is a critical-severity vulnerability in Lightcms Project Lightcms with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 2% (82nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Lightcms Project Lightcms
Published: 2021-04-15
Last modified: 2026-06-17

Description

LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading of external images.

Frequently asked questions

What is CVE-2021-27112?: LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading of external images.
How severe is CVE-2021-27112?: CVE-2021-27112 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-27112 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-27112?: CVE-2021-27112 affects Lightcms Project Lightcms. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-27112?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2021-27112 published?: CVE-2021-27112 was published on 2021-04-15 and last updated on 2026-06-17.

References

https://github.com/eddy8/LightCMS/issues/19

Affected products (1)

cpe:2.3:a:lightcms_project:lightcms:1.3.5:*:*:*:*:*:*:*

More vulnerabilities in Lightcms Project Lightcms

CVE-2023-27060 — Critical (CVSS 9.8): LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function.
CVE-2026-29934 — Medium (CVSS 6.1): A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2.0 allows attackers to…
CVE-2024-22559 — Medium (CVSS 5.4): LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field.
CVE-2021-3355 — Medium (CVSS 5.4): A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable…
CVE-2022-33009 — Medium (CVSS 4.8): A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts…

All CVEs affecting Lightcms Project Lightcms →