High severity7.5NVD Advisory· Published Apr 28, 2021· Updated Jun 17, 2026

CVE-2021-31863

Description

Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Redmine/Redmine3 versions
cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*range: <4.0.9
- (no CPE)
- (no CPE)range: <4.0.9, <4.1.3, <4.2.1
Debian/linux
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
osv-coords
pkg:bitnami/redmine
Range: < 4.0.9

Patches

Vulnerability mechanics

References

lists.debian.org/debian-lts-announce/2021/05/msg00013.htmlnvdMailing ListThird Party Advisory
www.redmine.org/news/131nvdVendor Advisory
www.redmine.org/projects/redmine/wiki/Security_AdvisoriesnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000