CVE-2021-47746
NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write
- State
- Published
- Severity
- 8.6 High
- Published
- Jan 21, 2026
- Updated
- Mar 5, 2026
- Reserved
- Dec 31, 2025
Description
NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through the emoji upload API. Attackers with admin access can craft file upload requests with directory traversal to overwrite system files by manipulating the file path parameter.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-73 External Control of File Name or Path
Affected Products
| Product | Versions |
|---|---|
NodeBB Plugin EmojiNodeBB |
|
References
- ExploitDB-49813exploit
- Official NodeBB Homepageproduct
- NodeBB Emoji Plugin GitHub Repositoryproduct
- VulnCheck Advisory: NodeBB Plugin Emoji 3.2.1 - Arbitrary File Writethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.