CVE-2021-26618CWE-20

Tmax ToOffice arbitrary file creation vulnerability

High · published February 18, 2022

CVSS v3.1
7.1
EPSS
1%
Percentile
62.4
In the wild
Unconfirmed
What it is

An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitrary file included malicious code.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00997 · 62.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2022-02-18T17:50Z
EPSS history
Timeline
  • 18 FEB 17:50Z
    Tmax ToOffice arbitrary file creation vulnerability
    cvelistv5