CVE-2021-43934 CRITICAL

CVE-2021-43934: Elcomplus SmartPtt Unrestricted Upload of File with Dangerous Type

Vendor Elcomplus

Product SmartPTT

Weakness CWE-434 · Unrestricted file upload

Published April 28, 2022

Last update April 16, 2025

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files.

Key dates

02Disclosure timeline

April 28, 2022 CVE published

April 16, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-43934 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2026-6211 Arbitrary File Upload in Global IT's WEOLL CVE-2026-10172 Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload CVE-2026-40548 Unrestricted Upload of File with Dangerous Type in SOPlanning CVE-2026-34027 Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary files CVE-2026-11621 Dcat-Admin User Setting upload editorMDUpload unrestricted upload