AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2021-22140

HIGH · CVSS 7.5 EPSS 1.27%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2021-05-13 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE
CVE-2021-22140
Severity
HIGH
CVSS
7.5
EPSS
1.27%

Original NVD Description

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files.