Medium severity4.2NVD Advisory· Published Dec 2, 2021· Updated Jun 17, 2026

CVE-2021-23258

Description

Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Crux Software/Crafter CMSv5
Range: 3.1
Craftercms/Crafter CMS
cpe:2.3:a:craftercms:crafter_cms:*:*:*:*:*:*:*:*
Range: >=3.1.0,<3.1.12

Patches

Vulnerability mechanics

References

docs.craftercms.org/en/3.1/security/advisory.htmlnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.273
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000