CVE-2021-39271

Published: Aug 30, 2021Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the class attribute of a .bscw file. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.

Affected (5)

Products: Bscw: Bscw Classic

Bscw

1 product

Bscw Classic

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Bscw Bscw Classic	Before 5.0.12
Bscw Bscw Classic	From 5.1.0 to 5.1.10
Bscw Bscw Classic	From 5.2.0 to 5.2.4
Bscw Bscw Classic	From 7.3.0 to 7.3.3
Bscw Bscw Classic	From 7.4.0 to 7.4.3