PT-2026-41464 · Processmaker · Processmaker

Ai Ho · Published 2026-05-16 · Updated 2026-05-16 · CVE-2021-47978

Mitre

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without authentication.

Exploit

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2021-47978

Affected Products

Processmaker

References · 4

• 🔥 https://exploit-db.com/exploits/50229 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47978 · Security Note
• https://vulncheck.com/advisories/processmaker-local-file-inclusion-via-path-traversal · Note
• https://processmaker.com · Note