PT-2021-15657 · Facebook · Whatsapp For Android+1

Published 2021-06-11 · Updated 2025-09-03 · CVE-2021-24035

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WhatsApp for Android versions prior to 2.21.8.13 WhatsApp Business for Android versions prior to 2.21.8.13

Description: The issue is related to a lack of filename validation when unzipping archives, which could have allowed path traversal attacks to overwrite files.

Recommendations: For WhatsApp for Android versions prior to 2.21.8.13, update to version 2.21.8.13 or later. For WhatsApp Business for Android versions prior to 2.21.8.13, update to version 2.21.8.13 or later.

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2021-24035

Affected Products

Whatsapp Business For Android

Whatsapp For Android

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-24035 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24035 · Vendor Advisory
• https://whatsapp.com/security/advisories/2021 · Vendor Advisory
• https://t.me/cvenotify/16150 · Telegram Post
• https://t.me/cveNotify/134215 · Telegram Post