Medium severity5.0NVD Advisory· Published Nov 29, 2021· Updated Jun 17, 2026
CVE-2021-43788
CVE-2021-43788
Description
Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected languages/ directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nodebbnpm | >= 1.0.4, < 1.18.5 | 1.18.5 |
Affected products
3Patches
Vulnerability mechanics
References
7- github.com/NodeBB/NodeBB/commit/c8b2fc46dc698db687379106b3f01c71b80f495fnvdPatchThird Party AdvisoryWEB
- blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/nvdExploitThird Party Advisory
- github.com/NodeBB/NodeBB/releases/tag/v1.18.5nvdRelease NotesThird Party AdvisoryWEB
- github.com/NodeBB/NodeBB/security/advisories/GHSA-pfj7-2qfw-vwgmnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-pfj7-2qfw-vwgmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-43788ghsaADVISORY
- blog.sonarsource.com/nodebb-remote-code-execution-with-one-shotghsaWEB
News mentions
0No linked articles in our index yet.