CVE-2021-45834
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
A vulnerability in OpenDocMan 1.4.4 allows an attacker to bypass MIME type checks when uploading files via add.php. This can lead to automatic processing of malicious files within the product's environment or remote code execution.
Risk Assessment
The risk includes potential server compromise through arbitrary code execution, which may result in loss of confidentiality, integrity, and availability of organizational data.
Recommendation
Immediately update OpenDocMan to the latest version and implement server-side file type validation independent of the MIME header.
Original NVD description (English source)
An attacker can upload or transfer files of dangerous types to the OpenDocMan 1.4.4 portal via add.php using MIME-bypass, which may be automatically processed within the product's environment or lead to arbitrary code execution.