CVE-2021-21029: Magento admin reflected XSS via file parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe flaw requires an authenticated admin and user interaction and yields limited confidentiality and integrity impact, but the high EPSS score and admin-console target keep it worth prompt patching.

What it is

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier contain a reflected cross-site scripting flaw reached through the 'file' parameter. Because the vulnerable path sits in the admin console, an attacker must first get an authenticated administrator to trigger the crafted request, after which arbitrary JavaScript runs in that admin's browser.

Impact

An attacker who lands the payload gains script execution in an administrator's browser session, which can be used to read or alter admin-visible data and perform actions as that administrator. The scope change in the CVSS vector reflects that the injected script can affect resources beyond the vulnerable component.

Attack surface

Reached over the network through a crafted request containing the 'file' parameter; the vector shows high privileges required (PR:H) and user interaction required (UI:R), meaning an authenticated admin must be induced to follow or submit the crafted link.

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tags appear in the references, which are vendor advisories only; EPSS is high at 0.84641 (99.7th percentile), indicating elevated predicted likelihood despite the absence of confirmed in-the-wild use.

What to do

• Apply the vendor fix from Adobe security bulletin APSB21-08 for Magento, upgrading to a patched release.
• If immediate patching is not possible, restrict and monitor admin console access to trusted networks and accounts.
• Enforce output encoding and input validation on the 'file' parameter and similar admin request parameters.
• Deploy a WAF or CSP that blocks reflected script execution on admin endpoints.
• Train administrators not to open unsolicited links or attachments that target the admin console.

Detection

• Search web and proxy logs for requests to admin paths carrying script-like content in the 'file' parameter.
• Alert on reflected payload strings (script tags, event handlers, javascript: URIs) appearing in admin request parameters.
• Monitor admin sessions for anomalous actions or requests following a suspicious link click.
• Review WAF and CSP violation logs for blocked inline script execution on admin pages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.